Security audit

Nano Banana Pro 种草图片

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly aligned with image generation, but its automatic result download can write server-controlled files outside the chosen output folder.

Review before installing. Use only with the official AI Hive endpoint or another endpoint you fully trust, avoid custom --base-url values, prefer --no-download or an isolated output directory until filename containment and download size limits are fixed, and install dependencies in a virtual environment. Expect the init command to store an API key in your home directory.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/imagegen.py:387
Finding: Server-Controlled Path Traversal and Arbitrary File Overwrite
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/imagegen.py:312
Finding: Unbounded Server-Directed Download Can Exhaust Local Storage
Content: View full analysis
0: pct = int(downloaded * 100 / total) bar = "█" * (pct // 5) + "░" * (20 - pct // 5) print(f"\r {bar} {pct}% ({downloaded // 1024}KB)", end="", flush=True) ``` ### Technical Analysis Generation result URLs are supplied by the remote API and downloaded automatically. The implementation does not enforce: - A maximum `Content-Length`. - A maximum number of streamed bytes. - An allowlist of trusted result hosts. - A requirement that result URLs use HTTPS. - Restrictions on redirects to different hosts. - Cleanup of a partial file when the download fails or exceeds an acceptable limit. The `timeout` value passed to `requests` is not a total download-duration or file-size limit. A remote server that continuously sends data within the socket read timeout can keep the transfer active while consuming local disk space. Although the code reads `Content-Length`, the value is only used to display progress. It is not used as a security limit, and servers may omit or falsify it. ### Attack Path 1. An attacker controls the configured API endpoint or compromises the legitimate generation service. 2. The victim submit ...[truncated 1266 chars]
Remediation: View remediation
MAX_DOWNLOAD_BYTES: raise ValueError("Download exceeds the permitted size") downloaded = 0 for chunk in resp.iter_content(chunk_size=8192): if not chunk: continue downloaded += len(chunk) if downloaded > MAX_DOWNLOAD_BYTES: raise ValueError("Download exceeded the permitted size") f.write(chunk) ``` 4. Download into a temporary file and delete it on every failure, size-limit violation, or interruption. 5. Require HTTPS and allowlist the expected object-storage hosts. 6. Validate redirect destinations or disable automatic redirects and process each redirect explicitly. 7. Apply separate connection and read timeouts and, where practical, enforce an overall transfer deadline. 8. Verify the downloaded media type and file signature before publishing the file under its final name. ]]>

T08 · Insecure Dependencies

Note

Location: SKILL.md:77
Finding: Unpinned Runtime Dependency Installation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared purpose is narrowly framed as Nano Banana Pro seeding-image generation, but the detected behavior includes substantially broader capabilities such as chat, video generation, model discovery, API-key setup, browser interaction, uploads, and account or wallet access. This mismatch is dangerous because users and policy systems may authorize the skill under a narrow trust assumption while it can perform actions involving credentials, external services, and unrelated data flows.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file uses Chinese throughout its substantive entries, which can impose a language constraint on users without opt-in. The policy for natural-language violations applies to all file types, and there is no indication here that the skill is intentionally region- or locale-specific or that alternative language support is offered.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill exposes or implies shell, network, file, and environment capabilities without declaring an explicit tool scope or permissions boundary. That increases the chance that a caller or orchestrator will grant broader access than the user expects, enabling filesystem access, network calls, package installation, and command execution beyond simple image generation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description says to use this skill for a wide range of generic topics and platforms, including lifestyle content, product sharing, travel, beauty, home, and UGC-style materials. This broad phrasing does not clearly distinguish when this skill should activate versus other image-generation skills, and it provides no negative examples or scope constraints.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file is presented as a narrowly scoped Nano Banana Pro image skill, but the implementation is a broad AI Hive client that supports unrelated capabilities such as chat, video, model discovery, uploads, and account operations. This capability mismatch violates least privilege and increases the attack surface, making it easier for a supposedly simple skill to be repurposed for unintended API access or data handling.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The module documentation explicitly describes the script as a general AI capability tool, contradicting the specific identity under which it is shipped. This kind of misleading packaging undermines informed trust and review, and in security terms it can conceal broader capabilities than operators expect.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The module docstring and user-facing help/instructions are written in Chinese, and the CLI prompts and status messages throughout the file are also Chinese-only. This imposes a specific language/locale on users without offering a choice or documenting that the skill is intended only for a Chinese-speaking or region-specific context.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Exposing user-info and model-listing functions in an image-only skill gives the skill unnecessary account-inspection and environment-discovery powers. Even if not overtly malicious here, these capabilities can reveal wallet/account metadata and enumerate available models, which is useful for reconnaissance and outside the declared purpose of the skill.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Including full text-chat support in a skill advertised only for Nano Banana Pro seeding images expands the skill beyond its declared trust boundary. This creates an unnecessary channel for arbitrary prompt submission and model interaction, which can be abused for unintended content generation, data processing, or policy bypass attempts.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Video-generation support is unrelated to the manifest’s image-focused purpose and materially broadens what the skill can do with the same API credentials. This larger capability set raises misuse risk, especially because it also accepts multiple media types and task flows not needed for the advertised function.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The title and primary instructional content are written in Chinese, and the examples are framed around Chinese-language social content contexts without stating that users may choose another language. This can violate language/locale policy if the skill implicitly constrains interaction to a specific language without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The placeholder value 请替换为你的APIKey is Chinese text embedded directly in the example configuration. This imposes a specific language in user-facing natural language content without offering a language choice or documenting a locale-specific reason.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.