Security audit

Nano Banana Pro 海报生成

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches an AI Hive poster-generation workflow, but it handles API credentials in a way that can send them to arbitrary configured endpoints and includes broader AI Hive client capabilities than the poster purpose needs.

Review this before installing if you will use a real AI Hive API key. Use only the default trusted AI Hive endpoint, avoid setting AI_HIVE_BASE_URL or --base-url unless you fully trust the destination, and prefer installing dependencies in an isolated environment. Expect the skill to store an API key locally, upload selected media to AI Hive/object storage, and download generated outputs.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/imagegen.py:71
Finding: Bearer API Credential Can Be Transmitted to an Arbitrary Endpoint
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:67
Finding: Unpinned Dependency Installation Produces a Non-Reproducible Supply Chain
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file is presented as a narrowly scoped Nano Banana Pro poster skill, but actually embeds a broad general-purpose AI Hive client with unrelated capabilities such as chat, video, model discovery, uploads, and account access. This scope mismatch is dangerous because it defeats least-privilege expectations and can mislead users, reviewers, or orchestrators into granting a poster skill much broader operational power than advertised.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Video generation plus arbitrary image/video/audio upload handling is materially outside the declared poster/image scope and greatly increases the skill’s capability surface. In practice, this allows the skill to process additional media classes and invoke more powerful workflows than users and policy reviewers would expect from a poster generator.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The CLI advertises a fixed Nano Banana Pro poster interface, yet still exposes generic commands for models, chat, video, user-info, and upload in the same codebase. Even if the final skill_main narrows the entrypoint, bundling these extra interfaces in a purportedly fixed-function skill undermines trust, increases audit complexity, and creates latent opportunities for misuse or future exposure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file contains user-facing natural language exclusively in Chinese across the substantive changelog entries. Under the policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill invokes shell commands, installs a package from the network, and uses a Python script with file and environment access, but it does not declare any explicit tool scope or permissions. This creates an overbroad execution surface where an agent may grant or assume more capabilities than necessary, increasing the risk of unintended command execution, network access, or file modification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description and the full skill instructions are presented in Chinese, and the skill does not indicate that users may choose another language or locale. This creates a natural-language locale constraint without explicit opt-in, which matches the policy category for language or locale violations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The module docstring and all user-facing CLI guidance are written in Chinese, presenting the skill as a general-purpose tool rather than a region-specific or Chinese-only skill. Under the policy, forcing a specific language without opt-in is a natural-language policy issue when no alternative language choice or justification is provided.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Exposing user-info and wallet balance inspection is outside the stated purpose of poster generation and grants the skill visibility into account metadata that users would not reasonably expect to disclose for image creation. In the context of an agent skill, this expands data access unnecessarily and can aid profiling, billing reconnaissance, or misuse of linked account context.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The general text chat path is unrelated to a fixed-purpose poster generator and permits arbitrary prompt forwarding to a text model, materially broadening the skill beyond its declared function. This can be abused as an unsanctioned generic LLM proxy and bypass platform expectations or policy gating tied to the skill’s advertised image-only scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The sample value for api_key includes the Chinese phrase 请替换为你的APIKey, which imposes a specific language in user-facing text. For a general example config file, this is a locale-specific instruction without any indication that the skill is region-specific or that users can choose their language.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.