Nano Banana Pro 商品详情页

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:59 AM UTC
• Version: 1.0.0

Overview

This image-generation skill mostly matches its stated purpose, but it handles an AI Hive API key in a way that can send the bearer credential to an arbitrary configured API endpoint.

Review before installing. Use only the official AI Hive endpoint, avoid setting AI_HIVE_BASE_URL or --base-url to third-party hosts, and prefer a dedicated API key you can revoke. Install dependencies in a virtual environment and inspect what files you upload as references.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/imagegen.py:94

Finding

Configurable API Endpoint Can Expose Bearer Credentials to an Untrusted Server

Content

View full analysis

Vulnerability Details

File Location: scripts/imagegen.py:94-100, scripts/imagegen.py:132-144, and scripts/imagegen.py:587
Vulnerability Type: Unrestricted credential destination and missing transport enforcement
Risk Level: Medium

Vulnerable Code

python

def _resolve_base_url(self, cli_url):
    if cli_url:
        return cli_url.rstrip("/")
    env_url = os.environ.get("AI_HIVE_BASE_URL")
    if env_url:
        return env_url.rstrip("/")
    file_config = self._read_config_file()
    if file_config.get("base_url"):
        return file_config["base_url"].rstrip("/")
    return DEFAULT_BASE_URL

python

self.headers = {
    "Authorization": f"Bearer {config.api_key}",
    "Content-Type": "application/json",
}

python

def _request(self, method, url, **kwargs):
    self.config.log(f"{method} {url}")
    try:
        resp = requests.request(
            method, url, headers=self.headers, timeout=DEFAULT_TIMEOUT, **kwargs
        )

python

parser.add_argument("--base-url", help=f"API Base URL (default {DEFAULT_BASE_URL})")

Technical Analysis

The authenticated API destination can be overridden through a command-line argument, the AI_HIVE_BASE_URL environment variable, or ~/.ai-hive/config.json. The resulting URL is used without validating its scheme or hostname.

Every request made through AiHiveClient._request() includes the AI Hive bearer credential. Consequently, a custom endpoint receives the same Authorization header intended for the official AI Hive service. The implementation also permits a plaintext http:// endpoint, allowing credentials and request contents to be exposed to a network attacker.

Exploitation requires influence over the command invocation, process environment, or configuration file. This could occur through malicious setup instructions, a poisoned shell environment, configuration tampering by another pr ...[truncated 1530 chars]

Remediation

View remediation

Remediation Suggestions

1. Require the API base URL to use HTTPS and reject plaintext HTTP:

   python

   from urllib.parse import urlparse
   
   parsed = urlparse(base_url)
   if parsed.scheme != "https":
       raise SystemExit("The API base URL must use HTTPS")
   

2. Allowlist the official hostname, ai-hive.iclip.cn, for requests that carry an AI Hive API key.
3. If custom endpoints are a legitimate feature, require a separate credential for each origin and never automatically forward an AI Hive credential to a non-official host.
4. Display the resolved hostname and require explicit interactive confirmation before sending credentials to a custom endpoint.
5. Reject URLs containing embedded user information, unexpected ports, fragments, or malformed hostnames.
6. Document the security implications of --base-url and AI_HIVE_BASE_URL.
7. Provide API-key revocation and rotation guidance for users who may have connected to an untrusted endpoint.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:73

Finding

Unpinned Dependency Installation Creates Supply-Chain Exposure

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:73 and scripts/imagegen.py:7-21
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Low

Vulnerable Code

SKILL.md instructs users to install the dependency without a version constraint or integrity verification:

bash

pip3 install requests

The implementation repeats the same unpinned installation instruction:

python

"""AI Hive OpenAPI Skill — general AI capability invocation tool.

Dependencies: requests (pip3 install requests)
"""

python

try:
    import requests
except ImportError:
    print("Missing dependency: requests. Run pip3 install requests", file=sys.stderr)
    sys.exit(1)

Technical Analysis

The project does not provide a locked dependency manifest, exact version constraint, or package hash. Running pip3 install requests resolves whatever release and transitive dependencies are available from the active Python package index at installation time.

This makes installation non-reproducible and leaves the project dependent on future upstream releases, the security of the configured package index, and the integrity of transitive dependency resolution. Although no malicious dependency is present in the audited repository, the installation procedure does not protect users against a compromised index, compromised upstream release, malicious mirror, or unexpected incompatible update.

Attack Path

1. The user follows the documented installation command.
2. Pip contacts the configured package index or mirror and resolves the latest acceptable requests package and its transitive dependencies.
3. An attacker who has compromised the selected package source, mirror, release artifact, or dependency-resolution environment supplies a malicious package artifact.
4. Pip installs the artifact into the user's Python environment.
5. Malicious package code executes during installatio ...[truncated 808 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a reviewed dependency file with an exact version:

   text

   requests==REVIEWED_VERSION
   

2. Generate and verify cryptographic hashes, for example through a hash-locked requirements file and:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

3. Lock transitive dependencies as well as the direct requests dependency.
4. Install dependencies inside a dedicated virtual environment rather than the global Python environment.
5. Use a trusted package index over HTTPS and avoid unreviewed mirrors.
6. Add automated dependency vulnerability and integrity scanning to the release process.
7. Periodically update the locked versions after reviewing security advisories and testing compatibility.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown file contains user-facing natural language almost entirely in Chinese, but it does not indicate that the skill is region-specific or provide any opt-in or alternative language. Under the policy rules, forcing a specific language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill invokes shell commands, installs a package with pip, accesses environment-derived paths, and uses a script that likely performs file and network operations, but it declares no explicit tool restrictions. This increases the attack surface because an agent may grant broader execution capabilities than necessary, enabling unintended command execution, file access, or outbound network activity if the skill is triggered in the wrong context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The description contains broad trigger phrases covering many common e-commerce and design scenarios, which can cause the skill to activate for generic image or product-page requests outside a narrowly scoped use case. Overbroad invocation is risky because it can route ordinary user requests into a skill with shell/network/file capabilities, increasing the chance of unnecessary code execution and data exposure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file is predominantly written as mandatory Chinese-language operating guidance for the skill, while the description mixes Chinese and English without stating that language choice is optional. This creates a language/locale constraint that may conflict with organizational policy requiring user opt-in for forced language selection.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file is presented as a narrow Nano Banana Pro product-detail-page image skill, but it actually ships a broad API client with unrelated capabilities including chat, video generation, model enumeration, account queries, and uploads. This violates least privilege and increases attack surface because a caller expecting a constrained image skill may unknowingly grant credentials to a much more powerful tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code file contains natural-language descriptions and CLI prompts entirely in Chinese, starting from the module docstring and continuing throughout the user interaction flow. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which it is not here.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Including user account and wallet-balance retrieval in a product-image skill grants access to account metadata unrelated to the stated task. In a skill ecosystem, this can expose sensitive billing or identity information to callers or downstream logs that only intended to generate images.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Generic text chat is unrelated to the advertised image-only product-detail-page workflow and materially broadens what the skill can do with the provided API key. In context, this is more dangerous because users may trust the skill as a tightly scoped image generator while it can also send arbitrary prompts and media to a remote model endpoint.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Video generation support is outside the stated scope of a Nano Banana Pro product-detail-page image skill and unnecessarily expands remote actions available under the same credentials. This mismatch makes the skill riskier because an agent or user may invoke capabilities with different cost, data handling, and content implications than expected.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

Even in the skill-specific parser, the commands are not limited to page-visual generation: users can query arbitrary generation tasks and upload files independently. Those operations may support implementation, but as exposed end-user capabilities they go beyond the manifest's narrow description of generating product detail page visual modules.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.