Nano Banana Pro 多参考图生成

• Outcome: Review
• Latest audit: Aug 17, 2026 · 9:44 AM UTC
• Version: 1.0.0

Overview

The skill’s normal entry point is mostly aligned with multi-reference image generation, but it ships under-disclosed generic AI Hive capabilities and persistent credential handling that deserve review before installation.

Install only if you are comfortable giving this skill an AI Hive API key and uploading chosen reference files to AI Hive. Prefer using the documented generate/task/init commands only, avoid passing sensitive local files as references, and be aware that the shipped helper contains broader generic AI Hive code than the skill description advertises.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill advertises executable behavior and operational capabilities such as shell, network, file read/write, and environment access without declaring permissions. This creates a transparency and policy-enforcement gap: users and hosting platforms cannot accurately assess or constrain what the skill may do, increasing the chance of over-privileged execution or unexpected data access.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose is narrowly framed as multi-reference image generation, but the underlying behavior reportedly includes generic chat, video generation, user/wallet queries, model enumeration, and broad media upload. This mismatch is dangerous because it hides materially broader functionality than users expect, enabling unnecessary access to account data, billing-related information, and expanded attack surface under a benign-looking skill description.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The file implements a broad, reusable AI Hive client with chat, image, video, upload, task polling, and account-inspection capabilities, while the declared skill is narrowly scoped to Nano Banana Pro multi-reference image generation. This scope mismatch is dangerous because surplus capabilities expand the attack surface and make it easier for downstream callers or wrappers to invoke unintended operations using the same API key.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The presence of a user-info/account inspection function is unrelated to the skill's stated purpose and enables disclosure of account metadata or wallet information whenever a valid API key is available. In a narrowly purposed image skill, exposing account inspection is unnecessary privileged functionality and violates least privilege.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The generic text chat path permits arbitrary model interaction unrelated to multi-reference image generation, creating a hidden capability channel through the same authenticated client. This increases misuse risk, including prompt-based data handling outside the skill's contract and unexpected billing or policy bypass through undeclared functionality.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: Video generation is a materially different and broader capability than the declared multi-reference image skill, and it allows uploading and processing of additional media types under the same credentials. This materially enlarges the attack surface, billing risk, and potential for misuse compared with the manifested skill purpose.

Intent-Code Divergence

High

• Confidence: 90% confidence
• Finding: The module-level documentation explicitly advertises a generic AI tool rather than a specialized Nano Banana Pro multi-reference image skill, which is consistent with the code exposing unrelated capabilities. This contradiction is dangerous because it obscures the actual privilege boundary and can mislead reviewers and operators about what the skill can do.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.