ClawHub
Back to skill

Security audit

nanobanana2-apiyi

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but it needs review because its credential handling can expose an API key and it sends prompt content to a third-party image API.

Review before installing. Use an environment variable or protected config for APIYI_API_KEY instead of --api-key, avoid --debug-key, do not put secrets or sensitive material in image prompts, and assume prompts plus generation settings will be sent to APIYI.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate_image.py:185
Finding

API Key Exposure Through Command-Line Arguments

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/generate_image.py:242
Finding

Partial API Key Disclosure in Debug Output

Content
View full analysis
= 8 else f"len={len(k)}" print("[debug-key] api_key_fingerprint=", safe, file=sys.stderr) ``` ### Technical Analysis When `--debug-key` is enabled, the script writes the API key's exact length and, for keys of at least eight characters, its first and last four characters to standard error. Standard error is frequently captured by terminal logs, CI systems, agent execution records, monitoring platforms, and support transcripts. Although the complete key is not printed, these values are still credential-derived information. They can identify or correlate a key, validate candidate credentials obtained elsewhere, and reduce the uncertainty remaining after another partial disclosure. Printing secret characters is unnecessary to confirm whether a credential was successfully loaded. The same debug block also discloses the user's home directory and the absolute configuration path. Those values are lower-sensitivity environmental details but are unnecessary for routine credential-source diagnostics. ### Attack Path 1. A user enabl ...[truncated 1099 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill invokes a Python script and requires an API key, implying code execution, environment access, and outbound network use, yet it does not declare any explicit tool scope or allowed-tools boundary. This weakens least-privilege enforcement and makes it harder for a host agent or reviewer to understand and constrain what the skill may access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill description and workflow do not clearly warn users that their prompts and related content will be transmitted to a third-party image-generation API. This creates a privacy and consent issue, especially if users include sensitive personal, business, or copyrighted material in their prompts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger guidance is broad enough to activate on common requests like 'generate an image' without clear narrowing conditions or consent checks. In practice, that can cause routine user content to be sent to an external service unexpectedly, increasing privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill mandates a Chinese-first prompt-selection workflow before generation, regardless of user preference. While not directly enabling code execution or data exfiltration beyond the API use already present, it overrides user intent and may transform user content in ways they did not request, creating avoidable consent and UX risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The instruction to always use English prompts forces translation or reformulation of user content without opt-in. This can alter meaning, introduce prompt drift, and send transformed content externally in a form the user did not approve, increasing consent and integrity concerns.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The hardcoded APIYI endpoint establishes a fixed external destination for all prompt and credential transmission. While not inherently malicious, a hardcoded third-party endpoint increases trust dependency on that provider and removes opportunities for administrators to redirect or constrain outbound traffic in sensitive environments.

Content

Scanner excerpt · scripts/generate_image.py (reported line 35)May include surrounding context.

python
) -> str:
    """Generate image via APIYI API."""
    
    url = "https://api.apiyi.com/v1beta/models/gemini-3.1-flash-image-preview:generateContent"
    
    headers = {
        "Authorization": f"Bearer {api_key}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The script transmits user-supplied prompts and an authorization bearer token to an external third-party service. In an agent-skill context, this is a real data egress boundary: sensitive user content entered into prompts may leave the local environment, and the API key is exposed to that remote provider for authentication. This is expected for an image-generation skill, but it remains a genuine privacy and supply-chain risk if users are not clearly informed.

Content

Scanner excerpt · scripts/generate_image.py (reported line 75)May include surrounding context.

python
print(f"Generating image with prompt: {prompt[:100]}...", file=sys.stderr)
    print(f"Aspect ratio: {aspect_ratio}, Size: {size}", file=sys.stderr)
    
    response = requests.post(
        url,
        headers=headers,
        json=payload,

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script defines suggestion features exclusively in Chinese, including function names, help text describing Chinese-only behavior, and hardcoded Chinese prompt content. This imposes a specific language/locale behavior without offering user opt-in or an alternative language path, which matches the policy's language-choice concern.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The skill's stated purpose is generating images from text descriptions, with prompt restructuring support. While calling the remote image API is expected, the additional capability to inspect the user's home-directory config file and OS environment for secrets is not justified by that narrow purpose as described in the manifest.

Content

No source excerpt is available for this finding.