Security audit

Nano Banana Pro 营销图片

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real AI marketing-image skill, but it needs review because it can upload arbitrary local files to an external service when given a path.

Install only if you trust AI Hive with the reference images and local files you explicitly pass to the tool. Avoid giving it paths to documents, secrets, source files, or broad home/workspace locations, and consider pinning dependencies before use.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/imagegen.py:257
Finding: Unrestricted Local File Upload Exceeds the Skill's Required Scope
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:74
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file contains substantive user-facing natural-language content almost entirely in Chinese, but it does not indicate that the skill is region-specific or provide any user opt-in for the enforced language. Under the policy criteria, forcing a specific language without choice or justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill invokes shell commands, installs packages, accesses files, and appears capable of network activity, but it declares no explicit tool scope or permission boundaries. That creates a privilege gap where the agent may execute broader actions than users expect, increasing the chance of unsafe file access, package installation, or command execution if the skill is triggered in an untrusted context.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The description uses broad trigger language for common marketing and image-generation tasks, making the skill likely to auto-match a wide range of ordinary user requests. When a skill with code execution and file/network capabilities is too broadly invocable, it can be selected unexpectedly and expose those capabilities in contexts where the user did not intend to run operational commands.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file presents the skill name and all operational instructions in Chinese and does not indicate that users may choose another language or locale. Under the language/locale policy, forcing a specific language without opt-in is a natural-language policy concern unless the constraint is clearly documented and justified.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file header and parser descriptions frame the code as a general-purpose AI capability tool, while the packaged skill claims to be a specialized Nano Banana Pro marketing-image skill. This inconsistency is dangerous because it obscures the true behavior and scope of the tool, undermining informed consent and making risky capabilities easier to hide inside a seemingly narrow skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code file contains user-facing natural-language descriptions and help text in Chinese, starting from the module docstring, and the CLI continues that pattern throughout. Because the skill does not offer users a language/locale choice or explain that it is intentionally region-specific, it can violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill is presented as a narrowly scoped Nano Banana Pro marketing-image generator, but the implementation still exposes generic API operations such as account/task introspection, upload utilities, and initialization flows beyond the advertised purpose. This scope mismatch increases attack surface and can mislead users into granting credentials or invoking broader platform capabilities than expected.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The sample API key value includes Chinese text ('请替换为你的APIKey'), which imposes a specific language in user-facing configuration content. There is no indication that the skill offers language choice or that a Chinese-only locale is required for a documented regional purpose.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill's stated purpose is creating Nano Banana Pro marketing visuals, but cmd_init opens a browser, guides a login flow, and writes persistent credentials to the user's home directory. Credential bootstrapping is operational account management, not an obvious part of the business purpose described in the manifest.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.