Security audit

Nano Banana 商品批次精修

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent product-image retouching purpose, but it needs review because its API-key handling and remote upload/download controls create avoidable exposure risks.

Review before installing if your product photos, packaging text, or API quota are sensitive. Prefer using AI_HIVE_API_KEY instead of putting the key on the command line, run it in an isolated environment, use --preview first, and avoid processing confidential images unless you trust AI Hive and its storage redirects.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/batch_calibrate.py:366
Finding: API Key Exposed Through Command-Line Arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/batch_calibrate.py:313
Finding: API Key File Is Protected Only After It Is Written or Read
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/batch_calibrate.py:202
Finding: API-Controlled Upload Destination Is Not Restricted to Trusted Hosts
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/batch_calibrate.py:256
Finding: Result Downloads Lack Host, Size, and Content Validation
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:29
Finding: Runtime Dependency Is Installed Without Version or Integrity Pinning
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill instructs users to run a local Python script that uses shell execution, filesystem access, environment/config secrets, and network calls, but it declares no tool restrictions or permission scope. This creates an unnecessarily broad trust boundary: an agent or runtime may permit capabilities beyond what the user expects, increasing the risk of secret exposure, unintended file access, or arbitrary command execution if the script or surrounding workflow is modified or abused.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The description and primary instructional content are written in Chinese, and the file does not state that users may choose another language or that the skill is restricted to a Chinese-language region or workflow. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: 该文件在顶层文档字符串中使用中文描述技能用途，且全文件的用户可见提示与 CLI 帮助文本也均为中文，体现出技能对输出语言/交互语言的默认强制设定。文件中没有提供语言切换、用户选择或区域合规性说明，因此符合语言/locale policy violation 的检查条件。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This JSON example includes the placeholder text "请替换为你的APIKey", which forces a specific language in user-facing configuration content. The policy for this review flags language or locale constraints when they are imposed without opt-in or documented justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.