Security audit

Nano Banana Pro 图片编辑

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed AI Hive image-editing skill, with user-directed image uploads and API-key setup that fit its stated purpose.

Install only if you are comfortable sending the selected images and prompts to AI Hive. Keep the API key private, review ~/.ai-hive/config.json if you initialize it, and do not use the upload command on files that are not intended image inputs.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill exposes shell, file, environment, and network capabilities without declaring permissions, which prevents users or the platform from understanding the true execution and data-access scope before use. In this context, the skill uploads images to an external service and initializes local configuration, so undeclared capabilities materially increase the risk of unexpected data exfiltration, local file access, or side effects.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented purpose is narrow image editing, but the underlying behavior reportedly includes account and wallet queries, model enumeration, general multimodal chat, video generation, standalone uploads, and interactive API key setup. This mismatch is dangerous because users may authorize or run the skill expecting only image edits, while it can access broader account metadata, transmit additional content types, and modify local configuration beyond the stated scope.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The upload path accepts arbitrary local files and infers MIME type from extension, while the skill is presented as an image-editing tool. In an agent setting, this can be abused to upload unrelated local data such as audio, video, or mislabeled files to the remote service, expanding the exfiltration surface beyond the expected image-only workflow.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill explicitly describes automatic upload, generation, and download through AI Hive but does not clearly warn users that source images will be transmitted to an external third-party service. Because image-editing inputs often contain personal, confidential, or proprietary visual data, omission of this disclosure can lead to unintended privacy breaches or policy violations when sensitive images are processed.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.