Security audit

Nano Banana Pro 文生图

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its image-generation purpose, but it needs Review because downloaded result URLs and filenames are not safely constrained.

Install only if you trust AI Hive and are comfortable storing an API key locally. Run it with a dedicated output directory, avoid privileged working contexts, and prefer a hardened version that validates download hosts and keeps all saved files inside the selected output folder.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/imagegen.py:270
Finding: Unrestricted Server-Controlled Result URL Enables Client-Side SSRF
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/imagegen.py:263
Finding: Server-Controlled Filename Components Permit Output Path Traversal
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill invokes shell commands, performs network requests, and writes local files, but it does not declare an explicit tool/permission scope. That creates a mismatch between advertised behavior and actual capability, increasing the risk of over-privileged execution, hidden side effects, or unsafe reuse in environments that rely on metadata for sandboxing and approval.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The description contains broad trigger phrases covering many common creative and image-generation requests, which can cause the skill to activate in situations where the user did not specifically request this tool. Over-broad auto-selection can route ordinary requests into a networked, file-writing skill unnecessarily, increasing data exposure and unintended side effects.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill’s natural-language description and operating instructions are written as Chinese-only usage guidance, and the workflow implicitly requires Chinese-language prompts and outputs without offering a language choice. This can violate language/locale policy when users have not opted into that locale.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This markdown file contains user-facing natural-language content exclusively in Chinese. Under the policy criteria, forcing a specific language without user opt-in can be a locale-policy issue when no alternative language option or justification is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The example API key placeholder includes Chinese-only instructional text in a config value. For a general-purpose example configuration, this imposes a specific language/locale without offering a choice or documenting a region-specific reason.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.