T09 · Insecure Skill Coding Practices
Error
- Location
scripts/imagegen.py:64- Finding
API Credential Disclosure Through an Unrestricted Base URL
- Content
View full analysis
- Remediation
View remediation
Security audit
Nano Banana Pro 精准文字图片
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its image-generation purpose, but it handles API keys and file transfers with overly broad endpoint controls that could expose credentials or selected files if misconfigured or pointed at an untrusted server.
Install only if you trust AI Hive and will keep the default API endpoint. Do not pass a custom --base-url or set AI_HIVE_BASE_URL unless you control and trust that endpoint, because it can receive your API key. Upload only files you intend to send to the service, use a limited-scope API key if available, and monitor output downloads for unexpectedly large files.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/imagegen.py:278- Finding
Unvalidated Server-Provided Upload and Download URLs
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
SKILL.md:69- Finding
Unpinned Runtime Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The documented purpose promises a tightly controlled exact-text image workflow with character-by-character review, but the observed behavior is a generic AI Hive client with broader undeclared capabilities and no implemented verification guardrail. This mismatch is dangerous because operators may trust the skill for compliance-sensitive text, legal copy, pricing, or medical claims when the skill does not actually enforce or validate those guarantees.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file presents itself as a narrowly scoped Nano Banana Pro exact-text image skill, but it actually embeds a much broader AI Hive client capable of chat, model enumeration, uploads, and video workflows. This scope mismatch violates least privilege and creates capability confusion: users or orchestrators may trust and approve the skill for image generation while unintentionally granting access to unrelated account and content operations.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Including full video-generation support inside an image-only skill materially broadens what the code can do if invoked directly or repurposed. This hidden capability undermines trust boundaries and allows generation and processing of additional media types that were not disclosed in the skill description.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The CLI exposes a video command with video and audio upload support, which directly contradicts the manifest's image-only purpose. In context, this is more dangerous because the skill is marketed for precise text-image creation, so reviewers or users may not expect arbitrary multimedia handling and may approve it under a narrower trust model.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill exposes shell, network, file read/write, and environment-backed execution paths but does not declare any tool restrictions or permissions. This increases the blast radius if the skill is invoked in a broader agent environment, because users and orchestrators cannot tell that the skill may install packages, access files, or make outbound requests.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The description says to use this skill for a wide range of common tasks such as posters, social covers, bilingual visuals, and e-commerce images, but it does not clearly define activation constraints or exclusion conditions. This broad wording increases the chance of unintended invocation for ordinary image-editing requests that merely mention text in images.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file embeds user-facing descriptions, help text, prompts, and errors in Chinese from the module docstring onward, but does not provide any opt-in or alternative language handling. That can violate language/locale policy because the skill effectively forces one language for all users regardless of preference.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Exposing user-info and model-listing functions is not necessary for an exact-text image generator and expands the attack surface beyond the stated purpose. In a skill ecosystem, this can enable unnecessary account inspection and service reconnaissance, especially if another component invokes the broader client assuming the skill is single-purpose.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file contains user-facing natural-language content exclusively in Chinese, and there is no indication that the skill is region-specific or that alternative language support is available. Under the policy criteria, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Static analysis
No suspicious patterns detected.