Nano Banana Pro 种草图片

• Outcome: Pass
• Latest audit: Aug 17, 2026 · 11:44 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed AI Hive image-generation helper, with some extra unused generic client code that should be treated as hygiene risk rather than active malicious behavior.

Install only if you are comfortable using AI Hive as a third-party service for prompts and reference images. The skill stores an API key locally if you run init, uploads files you explicitly pass as references, and saves generated outputs locally; avoid passing private images or files unless that matches your intended use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill invokes shell commands, installs packages, accesses environment variables via $SKILL_PATH, performs file I/O, and uses networked tooling, yet no permissions are declared. This creates a transparency and containment problem: users and orchestrators may treat the skill as low-risk content generation while it actually has broader execution and data-handling capabilities.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose is a narrowly scoped image-generation skill, but the underlying behavior reportedly includes generic OpenAPI access, chat/multimodal functions, video generation, model enumeration, wallet/user info access, uploads, and interactive browser/API-key setup. This mismatch is dangerous because it expands the attack surface beyond user expectations and could enable unintended data access, spending, or execution flows under the cover of a benign-seeming skill.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The file is presented as a skill for Nano Banana Pro image generation, but the implementation includes a broad generic AI client with chat, video generation, model enumeration, media upload, and account-related operations. This violates least privilege and creates capability drift: a caller expecting a narrowly scoped image skill can invoke unrelated network actions and access broader platform functionality than the manifest suggests.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill exposes a user-info API call even though its stated purpose is generating seeding images. Unnecessary access to account metadata can leak wallet, subscription, or identifying information to callers or downstream logs, expanding exposure beyond the user’s expected consent.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The CLI help text explicitly advertises querying user information and wallet balance, which is unrelated to the advertised image-generation purpose. Even if this is only an exposed command description, it signals and enables access to account/billing visibility that a narrowly scoped creative skill should not have.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill-specific entrypoint still exposes task lookup and raw upload operations in addition to generation. While less severe than chat/video exposure, this still broadens the attack surface and permits network/file transfer behaviors not clearly described in the skill manifest, which can surprise users and facilitate misuse.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.