ClawHub
Back to skill

Security audit

Nano Banana Pro 商品精修

Security checks across malware telemetry and agentic risk

Overview

This is a coherent product-photo retouch skill that uses AI Hive as expected, with credentials and image uploads that users should understand before use.

Use this only if you are comfortable sending selected product images and prompts to AI Hive and storing an AI Hive API key locally. Keep the default AI Hive base URL unless you intentionally want credentials sent to another endpoint, and retain original images for rollback as the skill advises.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill advertises and demonstrates commands that invoke a local Python script with shell, file, environment, and network access, yet it declares no permissions. This creates a transparency and consent problem: users may run a skill expecting a narrow photo-retouch workflow while the implementation can read/write local files, access environment variables, and make outbound requests, including during initialization.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
This is a true security-relevant mismatch: the skill is presented as a specialized product-retouch tool, but the referenced helper supports broader capabilities including API-key storage, browser launch, model enumeration, generic chat/multimodal use, video generation, arbitrary media upload, and task polling/download. Hidden general-purpose functionality materially increases attack surface and can mislead users into granting trust, credentials, or data access beyond the stated purpose.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.