T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/imagegen.py:231- Finding
Server-Controlled Upload Destination Is Not Validated
- Content
View full analysis
- Remediation
View remediation
Security audit
Nano Banana Pro 图生图
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly coherent for AI image editing, but its bundled script lets remote task data control upload/download destinations and output filenames too broadly.
Review this skill before installing if you will use private images or run it in a sensitive environment. Prefer an isolated Python environment, use a minimally scoped AI Hive key, choose a non-sensitive output directory, and be aware that result downloads and storage upload URLs are controlled by the remote service response without local validation.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/imagegen.py:350- Finding
Untrusted Task Metadata Can Control Download Destinations and Resource Consumption
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
SKILL.md:70- Finding
Dependency Installation Instructions Use an Unpinned Package
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill invokes local Python scripts, reads image files from user-supplied paths, writes local configuration and outputs, uses environment-held API keys, and performs network requests, yet it declares no explicit tool scope or permission boundary in metadata. This increases the risk of over-broad agent execution and makes it harder for a host system to enforce least privilege or present clear consent around shell, file, env, and network access.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest description says to use this skill for broad phrases like '照片风格化', '人物换场景', and '室内改造' without defining clear boundaries or exclusions. These are common user intents that could match many unrelated image-editing tasks, increasing the risk of unintended invocation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill content and usage guidance are written entirely in Chinese while the description mixes Chinese and English and does not state that language is optional or user-selectable. This can constitute a locale/language policy issue if the skill implicitly expects or constrains interaction to one language without opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The module docstring and all user-facing CLI messages are written exclusively in Chinese, and the skill provides no option for users to select another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The changelog content is entirely written in Chinese, which constitutes a language-specific user-facing natural-language constraint. There is no indication that the skill is region-specific or that users can choose another language, so this appears to violate the language/locale policy requirement.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The placeholder value contains a Chinese-only instruction ('请替换为你的APIKey'), which imposes a specific language in user-facing natural language. The file does not provide an alternative language option or indicate that the locale restriction is intentional or region-specific.
- Content
Static analysis
No suspicious patterns detected.