Security audit

Nano Banana Pro 多参考图生成

Security checks for vulnerabilities and agentic risk

Overview

This image-generation skill mostly matches its stated purpose, but it stores an API key and can send that credential to a configurable API endpoint without hostname or HTTPS validation.

Review this skill before installing if you will use a real AI Hive API key. Keep the default AI Hive endpoint unless you fully trust a custom endpoint, avoid setting AI_HIVE_BASE_URL from untrusted instructions, and install dependencies in an isolated environment where possible.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/imagegen.py:91
Finding: Attacker-Controlled API Endpoint Can Receive the Bearer Credential
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:84
Finding: Third-Party Dependency Is Installed Without Version or Integrity Pinning
Content: View full analysis
``` ```python 依赖：requests（pip3 install requests） ``` ```python try: import requests except ImportError: print("缺少依赖：requests。请运行 pip3 install requests", file=sys.stderr) sys.exit(1) ``` ### Technical Analysis The installation instructions request the latest version of `requests` available from pip's configured package index. No exact version, lock file, package hash, or trusted index is specified. This makes installation non-reproducible and allows the resolved artifact and transitive dependency versions to change after the Skill has been reviewed. Risk arises if the configured package index is compromised, an unsafe private mirror is used, dependency resolution changes unexpectedly, or a future package or transitive dependency release is compromised. Installing into a global or user-wide Python environment without isolation can also modify dependencies used by unrelated applications. ### Attack Path 1. The user follows the documented `pip3 install requests` setup instruction. 2. Pip resolves `requests` and its transitive dependencies from the user's configured package index or mirror. 3. A compromised index, mirror, package release, or transitive dependency supplies malicious installation or runtime code. 4. Pip installs the package with the privileges of the invoking user. 5. The malicious code executes during package installation or when `scripts/imagegen.py` imports `requests`. 6. The code gains access to data and resources available to that user, potentially including the API key stored in `~/.ai-hive/config.json`. This finding does no ...[truncated 689 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill invokes shell commands, performs package installation, and uses a Python script that likely exercises network, file, and environment access, yet the manifest declares no explicit tool scope or permission boundaries. This increases the blast radius if the script is modified, compromised, or used with untrusted inputs, because an agent may grant broader capabilities than are actually required.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The manifest description is written as a Chinese-first instruction and includes no indication that users may choose their preferred language or locale. Under the stated policy, forcing or assuming a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The top-level docstring says this file is a '通用 AI 能力调用工具' that wraps text chat, image generation, video generation, model queries, media upload, and task polling. That actively conflicts with the manifest and generated skill config, which present this artifact as a dedicated Nano Banana Pro multi-reference image skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This Python skill’s top-level description, CLI guidance, prompts, and operational messages are written entirely in Chinese, which imposes a specific language/locale on all users. The file does not offer any opt-in, fallback, or language-selection mechanism, so it violates the language-choice policy for natural-language behavior.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest describes a narrowly scoped skill for combining multiple reference images into one controlled image via Nano Banana Pro. However, the shipped skill CLI also includes task, upload, and init subcommands, which perform generic account/bootstrap and media-management functions beyond the stated image-generation purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file contains user-facing natural language almost entirely in Chinese, but does not indicate that the skill is region-specific or provide any user opt-in for language/locale. Under the policy, forcing a specific language without user choice can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The example API key placeholder uses Chinese text ('请替换为你的APIKey'), which imposes a specific language in a user-facing config example. There is no indication that this skill is region-specific or that users may choose another locale, so this appears to violate the language/locale policy for natural-language content.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.