Nano Banana Pro 商品精修

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:03 AM UTC
• Version: 1.0.0

Overview

This skill mostly matches an AI product-photo retouch workflow, but it handles API credentials and can send them to a user/configured arbitrary endpoint without clear safeguards.

Review before installing. Use a dedicated virtual environment, pin dependencies if possible, avoid setting AI_HIVE_BASE_URL or --base-url unless you fully trust the endpoint, and treat product images and generated task data as uploaded to AI Hive. Rotate the API key if it may have been used with an untrusted endpoint.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:73

Finding

Unpinned Runtime Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:73; related dependency instructions also appear at scripts/imagegen.py:7 and scripts/imagegen.py:21
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code:

bash

pip3 install requests

The script repeats the same installation guidance when the dependency is unavailable:

python

try:
    import requests
except ImportError:
    print("缺少依赖：requests。请运行 pip3 install requests", file=sys.stderr)
    sys.exit(1)

Technical Analysis

The installation command retrieves the current version of requests and its transitive dependencies from the Python package index configured in the user's environment. The project provides no version constraint, lock file, package hashes, or verified package source.

Consequently, the installed code is determined at installation time rather than audit time. Risk can arise from a compromised package release, compromised transitive dependency, malicious package-index mirror, or hostile package-index configuration. Python packages may execute code during installation and will execute package code when imported by imagegen.py.

Attack Path

1. The user follows the documented pip3 install requests instruction.
2. pip resolves requests and its transitive dependencies from the user's configured index or mirror.
3. An attacker has compromised a resolved release, dependency, or configured mirror.
4. The malicious artifact executes during installation or when requests is imported.
5. The payload runs with the privileges of the user invoking pip or the Skill.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the invoking user's privileges. This may expose files, environment variables, the AI Hive API key, and other resources accessible to that account. If the installation command is run in a privileged environment, the im ...[truncated 163 chars]

Remediation

View remediation

Remediation Suggestions

• Declare a reviewed, exact version of requests and all transitive dependencies in a lock file.
• Include cryptographic hashes and install with pip install --require-hashes -r requirements.txt.
• Recommend installation in a dedicated virtual environment rather than the user's global Python environment.
• Use a trusted package index and document the expected index URL.
• Add automated dependency vulnerability and integrity scanning to the release process.
• Periodically update the lock file through a controlled review process rather than resolving unrestricted versions at runtime.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/imagegen.py:91

Finding

Bearer API Key Can Be Sent to an Arbitrary or Plaintext Endpoint

Content

View full analysis

Vulnerability Details

File Location: scripts/imagegen.py:91-100 and scripts/imagegen.py:130-143; the custom endpoint CLI option is declared at scripts/imagegen.py:587
Vulnerability Type: Unvalidated credential-bearing network destination
Risk Level: Medium

Vulnerable Code:

python

def _resolve_base_url(self, cli_url):
    if cli_url:
        return cli_url.rstrip("/")
    env_url = os.environ.get("AI_HIVE_BASE_URL")
    if env_url:
        return env_url.rstrip("/")
    file_config = self._read_config_file()
    if file_config.get("base_url"):
        return file_config["base_url"].rstrip("/")
    return DEFAULT_BASE_URL

The resolved URL is then used for requests carrying the bearer credential:

python

def __init__(self, config):
    self.config = config
    self.base = config.base_url
    self.headers = {
        "Authorization": f"Bearer {config.api_key}",
        "Content-Type": "application/json",
    }

def _url(self, path):
    return f"{self.base}/openapi/v1/{path}"

def _request(self, method, url, **kwargs):
    self.config.log(f"{method} {url}")
    try:
        resp = requests.request(
            method, url, headers=self.headers, timeout=DEFAULT_TIMEOUT, **kwargs
        )

The endpoint is also directly configurable through the command line:

python

parser.add_argument("--base-url", help=f"API Base URL (默认 {DEFAULT_BASE_URL})")

Technical Analysis

The base URL can come from a command-line argument, the AI_HIVE_BASE_URL environment variable, or ~/.ai-hive/config.json. The value is only normalized by removing a trailing slash. The implementation does not enforce HTTPS, verify that the hostname belongs to AI Hive, restrict ports, reject embedded user information, or require confirmation for non-default destinations.

AiHiveClient unconditionally adds the Authorization: Bearer header to every API request made thro ...[truncated 1736 chars]

Remediation

View remediation

Remediation Suggestions

• Require the https scheme for every credential-bearing API endpoint.
• Allow only the documented AI Hive hostname by default.
• Parse URLs with a standard URL parser and reject embedded credentials, fragments, unexpected ports, malformed hosts, and non-HTTP schemes.
• Do not attach the bearer token after cross-origin redirects; preferably disable redirects for authenticated API calls unless each destination is revalidated.
• If custom endpoints are operationally necessary, require an explicit high-friction opt-in and display the normalized destination before sending credentials.
• Separate credentials by endpoint so the production AI Hive key cannot automatically be reused with a custom server.
• Treat environment and configuration values as untrusted input and validate them identically to CLI input.
• Encourage immediate key revocation and rotation if a key may have been sent to an untrusted endpoint.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill is presented as a narrowly constrained product-retouch workflow, but the detected behavior indicates a much broader generic media/task wrapper with undeclared capabilities such as chat, video generation, model/user queries, uploads, and task management. That mismatch is dangerous because users and policy engines may trust the skill with sensitive product assets under false assumptions, while the underlying implementation can process data or generate outputs outside the claimed retouch-only scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file contains user-facing natural language entirely in Chinese across the substantive changelog entries. Under the policy, forcing a specific language without user opt-in or documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill advertises executable commands that install packages and invoke a Python script with shell, file, environment, and network access, but it does not declare any tool scope or permissions boundaries. This increases the blast radius of the skill because a caller or host cannot easily enforce least privilege, and the referenced script could perform actions beyond simple image retouching.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest description and the main instructional content are written as mandatory Chinese-language guidance, including phrases like '固定使用' and all example prompts in Chinese, with no indication that users may choose another language. This is a natural-language locale policy concern because the skill appears to enforce a specific language without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The top-level docstring describes the file as a '通用 AI 能力调用工具' that supports text chat, image generation, video generation, model queries, media upload, and task polling. But the actual entrypoint executed by this skill is skill_main, which restricts the exposed interface to a fixed-model image skill for Nano Banana Pro product retouch plus task/upload/init helpers.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code file contains natural-language docstrings and CLI prompts entirely in Chinese, and all user-facing interaction throughout the script follows that locale. The skill does not offer any language selection or opt-in, so it effectively enforces a specific language for all users.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest frames this skill as a focused product-photo retouch workflow using Nano Banana Pro. However, the shipped skill interface also includes standalone task and upload commands that let a caller inspect arbitrary generation tasks and upload files independently of the declared retouch flow, which broadens behavior beyond the manifest's stated editing purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The example value 请替换为你的APIKey is a Chinese-language instruction embedded directly in the config file. This imposes a specific language on users without opt-in or alternative locale support, which matches the language/locale policy concern for natural-language content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.