Nano Banana Image Skills

• Outcome: Pass
• Latest audit: May 29, 2026 · 8:37 PM UTC
• Version: 1.0.0

Overview

This skill does what it claims: it sends user-provided prompts and selected images to a Wisdom Gate/Gemini API to generate or refine images, with local output and optional conversation history files.

Install only if you are comfortable sending prompts, selected images, and prior refinement history to Wisdom Gate/Gemini. Use a dedicated revocable API key, avoid confidential or regulated images unless approved, and keep output and history paths limited to files intended for this skill.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill performs sensitive capabilities including environment access, local file reads/writes, and outbound network calls, but does not declare permissions or provide clear capability boundaries. This weakens reviewability and informed consent, making it easier for the skill to access secrets, persist user data, and transmit content externally without adequate visibility.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: The declared description understates important behavior: the skill persists conversation history to local storage, may use Google Search grounding, and supports capabilities beyond the stated scope. Description-behavior mismatch is risky because users and reviewers may consent to image generation without realizing their prompts and prior turns can be retained locally or augmented with external retrieval.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: For text-to-image requests, the code adds a google_search tool to the payload even though the skill description does not disclose any web-search capability. This expands data handling and model behavior beyond the manifest, potentially causing undisclosed outbound retrieval and unexpected prompt/data exposure to external search infrastructure.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README states that prompts, existing images, and conversation-based refinement are sent to a third-party remote API, but it does not prominently warn users that potentially sensitive content will leave the local environment. In an image-editing skill, users may provide personal photos or confidential visuals, so lack of explicit disclosure increases privacy and compliance risk.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger phrases are broad enough to match ordinary requests such as "draw" or "visualize," increasing the chance that the skill activates unexpectedly. In this context, over-triggering is more dangerous because the skill can send user prompts and possibly images to an external API and may persist refinement history locally.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation does not clearly warn users that prompts and input images are sent to a third-party API service. This is a genuine privacy and data-handling issue because users may provide sensitive text or images without understanding they will leave the local environment.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script automatically loads prior conversation history from a local JSON file and transmits the full contents, including prior prompts and model outputs, to a remote API. This can unintentionally disclose sensitive user data or generated content across runs without clear consent, which is especially relevant in a multi-turn image editing skill where users may reuse the same history file.

Memory Manipulation

High

• Category: Memory Poisoning

Content

- `prompt` (required): Refinement instruction or initial prompt
- `--history`: Conversation history file (default: `conversation.json`)
- `--output`: Output file path (default: `refined_image.png`)
- `--reset`: Reset conversation history and start fresh
- `--model`: Force specific model - `nano-banana`, `nano-banana-2`, `nano-banana-pro` (auto-select if not specified)
- `--quality`: Prioritize quality over cost (uses Nano Banana Pro)

• Confidence: 87% confidence
• Finding: Reset conversation

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.