ClawHub
Back to skill

Security audit

Nano Banana Pro 图生图

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed image-to-image helper that sends user-selected images to a fixed AI Hive API and saves generated outputs locally.

Before installing, understand that images you pass with --image will be uploaded to AI Hive and your AI Hive API key may be stored locally. Use only images you have rights to process, keep the API key private, and choose an output directory you are comfortable writing generated files into.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill documentation describes executable capabilities including shell execution, network access, local file read/write, and environment/config handling, but it does not declare permissions or present a clear capability boundary in a machine-enforceable way. This is dangerous because users or hosting agents may invoke the skill with broader access than expected, increasing the chance of unintended file exposure, command execution, or outbound data transfer.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.