nanobanana2-apiyi

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:44 PM UTC
• Version: 1.0.2

Overview

The skill does what it says, but it needs review because its credential handling can expose an API key and it sends prompt content to a third-party image API.

Review before installing. Use an environment variable or protected config for APIYI_API_KEY instead of --api-key, avoid --debug-key, do not put secrets or sensitive material in image prompts, and assume prompts plus generation settings will be sent to APIYI.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_image.py:185
• Finding: API Key Exposure Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generate_image.py:185-188` and `scripts/generate_image.py:214-218`; unsafe usage is also documented in `SKILL.md:110` **Vulnerability Type**: Credential exposure through process arguments **Risk Level**: Medium ### Complete Code Snippet ```python parser.add_argument( "--api-key", help="APIYI API key (override all other sources)" ) ``` ```python # Get API key # Priority: # 1) CLI --api-key # 2) openclaw.json top-level env.APIYI_API_KEY (requested behavior) # 3) OS env var APIYI_API_KEY (fallback) api_key = args.api_key api_key_source = "cli" if api_key else None ``` The documentation explicitly presents this method as supported: ```markdown Or use `--api-key` flag directly. ``` ### Technical Analysis The Skill accepts a long-lived API credential as a command-line argument. Process arguments are not an appropriate secret-transport mechanism because they may be exposed through: - Shell history files. - Process inspection utilities and operating-system process metadata. - Job runners, monitoring agents, audit systems, and diagnostic logs. - Command transcripts copied into support tickets or chat sessions. The API key is legitimately required to authenticate to APIYI, but exposing it through `argv` exceeds the minimum privilege and disclosure necessary for image generation. The existing environment-variable and configuration-file mechanisms can provide the credential without placing it directly in the command invocation. The script does not intentionally transmit the key to an unrelated endpoint. It uses the key as a Bearer token only for the declared APIYI service. The vulnerability is the local exposure created before the request is sent. ### Attack Path 1. A user follows the documented option and invokes the script with `--api-key sk-...`. 2. The complete command is recorded in shell history, process telemetry, CI logs, or another local observability system. 3. A local user, adminis ...[truncated 859 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `--api-key` argument, or mark it as deprecated and reject its use after a migration period. 2. Retrieve the key from `APIYI_API_KEY`, a credential manager, secure standard input, or a configuration file with restrictive permissions. 3. Correct the documentation so it does not recommend placing credentials in command-line arguments. 4. Align the documented configuration layout with the path actually read by the script. `SKILL.md` documents `skills.nano-banana2-apiyi.apiKey`, while the implementation reads top-level `env.APIYI_API_KEY`. 5. If a configuration file remains supported, verify that it is owned by the expected user and is not accessible to other users. 6. Advise users who previously supplied keys through `--api-key` to clear affected histories and logs and rotate potentially exposed credentials. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/generate_image.py:242
• Finding: Partial API Key Disclosure in Debug Output<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generate_image.py:242-254` **Vulnerability Type**: Sensitive credential metadata disclosure **Risk Level**: Low ### Complete Code Snippet ```python if args.debug_key: home = str(Path.home()) print("[debug-key] home=", home, file=sys.stderr) print("[debug-key] openclaw_json=", str(config_path), file=sys.stderr) print("[debug-key] openclaw_json_exists=", str(config_path.exists()), file=sys.stderr) print("[debug-key] openclaw_json_loaded=", str(config_loaded), file=sys.stderr) print("[debug-key] openclaw_json_has_env_apiyi_key=", str(config_has_key), file=sys.stderr) print("[debug-key] api_key_source=", (api_key_source or "none"), file=sys.stderr) # Only reveal length/prefix/suffix to help debugging without leaking secrets if api_key: k = str(api_key) safe = f"len={len(k)}, head={k[:4]}..., tail=...{k[-4:]}" if len(k) >= 8 else f"len={len(k)}" print("[debug-key] api_key_fingerprint=", safe, file=sys.stderr) ``` ### Technical Analysis When `--debug-key` is enabled, the script writes the API key's exact length and, for keys of at least eight characters, its first and last four characters to standard error. Standard error is frequently captured by terminal logs, CI systems, agent execution records, monitoring platforms, and support transcripts. Although the complete key is not printed, these values are still credential-derived information. They can identify or correlate a key, validate candidate credentials obtained elsewhere, and reduce the uncertainty remaining after another partial disclosure. Printing secret characters is unnecessary to confirm whether a credential was successfully loaded. The same debug block also discloses the user's home directory and the absolute configuration path. Those values are lower-sensitivity environmental details but are unnecessary for routine credential-source diagnostics. ### Attack Path 1. A user enabl ...[truncated 1099 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never print any prefix, suffix, length, hash, or other fingerprint derived from the API key. 2. Restrict debug output to non-secret state, such as whether a key was found and which supported source supplied it. 3. Avoid printing the full home directory or absolute credential-file path unless strictly required. 4. Ensure diagnostic errors do not include request headers or serialized authentication data. 5. Review existing logs and support transcripts for prior `api_key_fingerprint` output, restrict access to affected records, and delete them according to the applicable retention policy. 6. Rotate a credential if its fingerprint was broadly exposed and there is evidence of another related credential leak. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill invokes a Python script and requires an API key, implying code execution, environment access, and outbound network use, yet it does not declare any explicit tool scope or allowed-tools boundary. This weakens least-privilege enforcement and makes it harder for a host agent or reviewer to understand and constrain what the skill may access.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill description and workflow do not clearly warn users that their prompts and related content will be transmitted to a third-party image-generation API. This creates a privacy and consent issue, especially if users include sensitive personal, business, or copyrighted material in their prompts.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger guidance is broad enough to activate on common requests like 'generate an image' without clear narrowing conditions or consent checks. In practice, that can cause routine user content to be sent to an external service unexpectedly, increasing privacy and data-handling risk.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The skill mandates a Chinese-first prompt-selection workflow before generation, regardless of user preference. While not directly enabling code execution or data exfiltration beyond the API use already present, it overrides user intent and may transform user content in ways they did not request, creating avoidable consent and UX risk.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The instruction to always use English prompts forces translation or reformulation of user content without opt-in. This can alter meaning, introduce prompt drift, and send transformed content externally in a form the user did not approve, increasing consent and integrity concerns.

External Transmission

Medium

• Category: Data Exfiltration

Content

) -> str:
    """Generate image via APIYI API."""
    
    url = "https://api.apiyi.com/v1beta/models/gemini-3.1-flash-image-preview:generateContent"
    
    headers = {
        "Authorization": f"Bearer {api_key}",

• Confidence: 84% confidence
• Finding: The hardcoded APIYI endpoint establishes a fixed external destination for all prompt and credential transmission. While not inherently malicious, a hardcoded third-party endpoint increases trust dependency on that provider and removes opportunities for administrators to redirect or constrain outbound traffic in sensitive environments.

External Transmission

Medium

• Category: Data Exfiltration

Content

print(f"Generating image with prompt: {prompt[:100]}...", file=sys.stderr)
    print(f"Aspect ratio: {aspect_ratio}, Size: {size}", file=sys.stderr)
    
    response = requests.post(
        url,
        headers=headers,
        json=payload,

• Confidence: 86% confidence
• Finding: The script transmits user-supplied prompts and an authorization bearer token to an external third-party service. In an agent-skill context, this is a real data egress boundary: sensitive user content entered into prompts may leave the local environment, and the API key is exposed to that remote provider for authentication. This is expected for an image-generation skill, but it remains a genuine privacy and supply-chain risk if users are not clearly informed.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The script defines suggestion features exclusively in Chinese, including function names, help text describing Chinese-only behavior, and hardcoded Chinese prompt content. This imposes a specific language/locale behavior without offering user opt-in or an alternative language path, which matches the policy's language-choice concern.

Context-Inappropriate Capability

Low

• Confidence: 85% confidence
• Finding: The skill's stated purpose is generating images from text descriptions, with prompt restructuring support. While calling the remote image API is expected, the additional capability to inspect the user's home-directory config file and OS environment for secrets is not justified by that narrow purpose as described in the manifest.

Static analysis

No suspicious patterns detected.