ClawHub
Back to skill

Security audit

Nano Banana 商品详情页｜PDP 与 Amazon A+

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently generates ecommerce product-detail images through AI Hive and does not show hidden publishing, persistence, or unrelated data access.

Before installing, use a virtual environment and consider pinning `requests`. Only run panel generation with reference images you are allowed to upload to AI Hive, and use `preview` first or `--no-download` / `--output-dir` when you want tighter control over uploads and saved files.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:109
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:109 and scripts/nano_detail_panel.py:12-14
Vulnerability Type: Unpinned third-party dependency and supply-chain exposure
Risk Level: Medium

Vulnerable Code

SKILL.md:109:

bash
pip3 install requests

scripts/nano_detail_panel.py:12-14:

python
try:
    import requests
except ImportError:
    raise SystemExit("缺少 requests，请运行 pip3 install requests")

Technical Analysis

The documented installation command installs the latest version of the requests package and its transitive dependencies without enforcing exact versions or package integrity hashes. Consequently, the dependency contents resolved during installation can change after the Skill has been audited.

Although requests is a legitimate package, an unpinned installation remains exposed to package-index compromise, malicious or compromised dependency releases, and unexpected security or compatibility regressions in future versions. No lock file, hash-verified requirements file, or equivalent reproducible dependency specification is included in the project.

Attack Path

  1. An attacker compromises a dependency release, its publishing credentials, a configured Python package index, or another part of the dependency distribution path.
  2. A user follows the documented pip3 install requests instruction.
  3. pip resolves and downloads the currently available package and transitive dependencies without checking project-supplied hashes.
  4. Malicious installation behavior can execute with the privileges of the user running pip.
  5. Malicious runtime behavior may subsequently execute when nano_detail_panel.py imports or uses the installed package.

Impact Assessment

Successful exploitation could execute attacker-controlled code under the invoking user's account. Depending on that account's permissions, the attacker could access user-readable files, environment variables, API credentials, and network resource ...[truncated 340 chars]

Remediation
View remediation

Remediation Suggestions

  1. Add a dependency file containing exact, reviewed versions for requests and all resolved transitive dependencies.
  2. Include cryptographic hashes for every permitted distribution and require hash verification during installation.
  3. Replace the current instruction with a reproducible installation command, for example:
bash
python3 -m pip install --require-hashes -r requirements.txt
  1. Generate and review the lock file through a controlled dependency-update process rather than accepting automatic upgrades.
  2. Use a trusted package index over HTTPS and avoid undocumented or user-controlled extra indexes.
  3. Run dependency vulnerability and provenance checks in CI whenever the lock file changes.
  4. Install dependencies in an isolated virtual environment using a non-privileged account.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill invokes a local Python script and explicitly documents capabilities that imply shell execution, file access, environment use, and outbound network access, but it does not declare any restrictive tool scope or permissions. In an agent environment, this can lead to overbroad execution authority, making it easier for a compromised or misused skill to read local files, use secrets, or send data to external services beyond what users expect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The title and core operating instructions are written as a Chinese-only workflow for creating PDP and Amazon A+ assets, while the description also says to use the skill for international platforms such as TikTok Shop and Shopify. There is no statement offering a language choice or clarifying that Chinese is required only for a region-specific workflow, which creates a locale-policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code file contains natural-language strings that force a specific language/locale for all users. Under the policy, locale constraints should either be optional for the user or clearly justified as region-specific; that justification or opt-in is not present here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The code performs network transmission of user-provided local files via the upload-token flow and direct HTTPS upload. Although the tool’s purpose involves image generation, there is no clear disclosure at the upload point, in comments, or in output that local images will be sent to a remote service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
75% confidence
Finding

This function creates directories and writes downloaded content to local files. While it prints the saved path after completion, it does not disclose beforehand that running the command will create files under the configured output directory.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.