Nano Banana Pro 图片编辑

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:10 AM UTC
• Version: 1.0.0

Overview

This image-editing skill mostly matches its stated purpose, but it handles a persistent API key and can send that key to a user-configurable API server without validation or warning.

Install only if you trust the AI Hive service and will keep the default official base URL. Do not run this skill with an untrusted --base-url, AI_HIVE_BASE_URL, or modified ~/.ai-hive/config.json, because that can disclose your AI Hive API key. Prefer using an isolated Python environment and review any files you pass to --image or upload before sending them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:76

Finding

Unpinned third-party dependency installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:76
Vulnerability Type: Unpinned runtime dependency
Risk Level: Medium

Evidence

bash

pip3 install requests

Technical Analysis

The installation instructions retrieve and install the latest version of requests from the package index configured in the user's environment. No reviewed version, lock file, or package integrity hash is specified.

Consequently, the code installed when this instruction is followed can change independently of the audited project. Exploitation would require compromise of the configured package index, compromise of a future dependency release, or manipulation of pip's index configuration. The audit found no evidence that the current requests package is malicious.

Attack Path

1. An attacker compromises an applicable package release or controls the Python package index configured on the victim's system.
2. The victim follows the documented pip3 install requests instruction.
3. Pip downloads the attacker-controlled or unreviewed package version without checking a project-supplied hash.
4. Installation hooks or imported package code execute in the Python environment under the victim's privileges.

Impact Assessment

Malicious dependency code would execute with the privileges of the user running pip or invoking the Skill. Depending on those privileges, it could access files available to that account, steal the AI Hive API key, alter generated results, or perform arbitrary network operations. The issue does not independently provide privilege escalation beyond the invoking user's existing permissions.

Remediation

View remediation

Remediation Suggestions

• Pin requests and all transitive dependencies to versions that have been reviewed.
• Maintain dependencies in a lock file containing cryptographic hashes.
• Install with hash verification, such as pip install --require-hashes -r requirements.txt.
• Use an isolated virtual environment rather than the user's global Python environment.
• Configure pip to use a trusted package repository and verify the repository's TLS configuration.
• Add automated dependency vulnerability and update review processes.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/imagegen.py:91

Finding

Bearer API key can be transmitted to an unrestricted custom endpoint

Content

View full analysis

Vulnerability Details

File Location: scripts/imagegen.py:91-99, 130-143
Vulnerability Type: Unrestricted credential destination
Risk Level: Medium

Evidence

python

def _resolve_base_url(self, cli_url):
    if cli_url:
        return cli_url.rstrip("/")
    env_url = os.environ.get("AI_HIVE_BASE_URL")
    if env_url:
        return env_url.rstrip("/")
    file_config = self._read_config_file()
    if file_config.get("base_url"):
        return file_config["base_url"].rstrip("/")
    return DEFAULT_BASE_URL

python

def __init__(self, config):
    self.config = config
    self.base = config.base_url
    self.headers = {
        "Authorization": f"Bearer {config.api_key}",
        "Content-Type": "application/json",
    }

def _url(self, path):
    return f"{self.base}/openapi/v1/{path}"

def _request(self, method, url, **kwargs):
    self.config.log(f"{method} {url}")
    try:
        resp = requests.request(
            method, url, headers=self.headers, timeout=DEFAULT_TIMEOUT, **kwargs
        )

Technical Analysis

The API base URL may be supplied through the --base-url argument, the AI_HIVE_BASE_URL environment variable, or the configuration file. The value is accepted without validating its scheme or hostname.

The HTTP client then adds the AI Hive bearer API key to every request made against the selected base URL. This permits the credential to be sent to an attacker-controlled host or over plaintext HTTP. No HTTPS requirement, official-host allowlist, custom-endpoint warning, or separation between official and custom-endpoint credentials is implemented.

Exploitation requires an attacker to influence the victim's command, environment, or ~/.ai-hive/config.json. This finding does not establish that the default endpoint is malicious; the default is an HTTPS AI Hive URL.

Attack Path

1. An attacker influences a command, startup envir ...[truncated 1057 chars]

Remediation

View remediation

Remediation Suggestions

• Require the https scheme for all credential-bearing API endpoints.
• Allowlist the official API hostname for normal operation.
• If custom endpoints are necessary, require an explicit opt-in and display a prominent warning before transmitting credentials.
• Do not automatically reuse the official AI Hive credential with custom endpoints; require a separate credential supplied specifically for that endpoint.
• Reject URLs containing embedded credentials, unexpected ports, fragments, or non-HTTP schemes.
• Normalize and validate the hostname before use, including handling redirects safely.
• Disable cross-origin redirects for authenticated requests or strip the Authorization header whenever a redirect changes the origin.
• Add tests confirming that HTTP URLs and unapproved hosts are rejected before any network request is made.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Video-generation support is materially outside the declared Nano Banana Pro image-edit scope and introduces a much broader media-processing surface, including image, video, audio, and frame uploads. Because the skill is expected to handle image editing only, this hidden capability can be used to exfiltrate or process additional sensitive media types and consume resources in ways reviewers and users may not anticipate.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill invokes a Python script with network, shell, file read/write, and environment access, but the manifest does not declare any tool scope restrictions such as permissions or allowed-tools. That means an agent may grant broader capabilities than users expect, increasing the blast radius if the script, its dependencies, or task inputs are abused to access local files, environment secrets, or external services.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file is presented as a dedicated Nano Banana Pro image-edit skill, but actually embeds a generic AI Hive client with broad cross-capability support. This violates least privilege and expands the attack surface: a caller or integrator expecting narrowly scoped image editing may unknowingly gain access to unrelated platform functions and data flows.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module documentation explicitly describes a general-purpose AI capability tool, which contradicts the packaging and declared identity of a dedicated Nano Banana Pro image-edit skill. This kind of scope mismatch is dangerous because it can mislead reviewers, orchestrators, and users about what the code is actually capable of doing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module docstring and all user-facing CLI messages are written in Chinese, and there is no indication that other languages are supported or that Chinese is a justified requirement for a region-specific tool. This creates a natural-language locale policy issue because the skill effectively mandates one language without opt-in.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

User-info access exposes account-related information such as profile or wallet details that are unnecessary for image editing. This creates an avoidable privacy and account-enumeration surface, especially dangerous in a skill context where users may assume only media-edit operations are performed.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Model enumeration lets the skill discover platform-wide capabilities beyond its declared single-model purpose, undermining containment and enabling opportunistic access to other text, image, or video models. In a constrained skill environment, this is a privilege expansion vector because it reveals and facilitates use of capabilities not intended for this wrapper.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The chat capability is unrelated to the stated purpose of localized image editing and allows arbitrary text-model invocation through the same authenticated client. In a skill ecosystem, this creates hidden capability expansion and can be abused for prompt relay, policy bypass attempts, or unreviewed data transmission to models outside the declared scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file contains user-facing natural-language content entirely in Chinese across the substantive changelog entries. Under the policy rule, forcing a specific language without user opt-in or documented regional justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The example API key value uses Chinese text ('请替换为你的APIKey') as the only natural-language instruction in the file. This imposes a specific language choice without offering an alternative or documenting that the skill is intended only for a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.