ClawHub
Back to skill

Security audit

Nano Banana Image Skills

Security checks for vulnerabilities and agentic risk

Overview

This image-generation skill is purpose-aligned, but users should know prompts, input images, and refinement history may leave or persist outside the chat.

Install only if you are comfortable sending prompts, selected input images, and refinement context to Wisdom Gate/Gemini services. Avoid sensitive or regulated images unless approved, use a dedicated API key, install dependencies in a virtual environment, and keep conversation.json or custom history files out of shared folders, backups, and source control.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/refine_image.py:28
Finding

Plaintext Persistence of Sensitive Conversation and Image Data

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
README.md:17
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (24)

Tainted flow: 'headers' from os.getenv (line 79, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate_image.py (reported line 136)May include surrounding context.

python
print(f"Using model: {model}", file=sys.stderr)
    
    try:
        response = requests.post(api_url, headers=headers, json=payload, timeout=60)
        response.raise_for_status()
        result = response.json()

Tainted flow: 'headers' from os.getenv (line 57, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/refine_image.py (reported line 81)May include surrounding context.

python
print(f"Using model: {model}", file=sys.stderr)
    
    try:
        response = requests.post(api_url, headers=headers, json=payload, timeout=60)
        response.raise_for_status()
        result = response.json()

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The declared behavior understates what the skill actually does: it sends prompts and images to a third-party API, may enable external search grounding, and supports behavior not reflected in the public description. This mismatch can mislead users and orchestrators about data exposure and execution behavior, undermining informed consent and safe routing decisions.

Content

No source excerpt is available for this finding.

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · README.md (reported line 115)May include surrounding context.

md
- `prompt` (required): Refinement instruction or initial prompt
- `--history`: Conversation history file (default: `conversation.json`)
- `--output`: Output file path (default: `refined_image.png`)
- `--reset`: Reset conversation history and start fresh
- `--model`: Force specific model - `nano-banana`, `nano-banana-2`, `nano-banana-pro` (auto-select if not specified)
- `--quality`: Prioritize quality over cost (uses Nano Banana Pro)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md
- `prompt` (required): Refinement instruction or initial prompt
- `--history`: Conversation history file (default: `conversation.json`)
- `--output`: Output file path (default: `refined_image.png`)
- `--reset`: Reset conversation history and start fresh
- `--model`: Force specific model - `nano-banana`, `nano-banana-2`, `nano-banana-pro` (auto-select if not specified)
- `--quality`: Prioritize quality over cost (uses Nano Banana Pro)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · scripts/refine_image.py (reported line 132)May include surrounding context.

python
- `prompt` (required): Refinement instruction or initial prompt
- `--history`: Conversation history file (default: `conversation.json`)
- `--output`: Output file path (default: `refined_image.png`)
- `--reset`: Reset conversation history and start fresh
- `--model`: Force specific model - `nano-banana`, `nano-banana-2`, `nano-banana-pro` (auto-select if not specified)
- `--quality`: Prioritize quality over cost (uses Nano Banana Pro)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · scripts/refine_image.py (reported line 140)May include surrounding context.

python
args = parser.parse_args()
    
    # Reset history if requested
    if args.reset and os.path.exists(args.history):
        os.remove(args.history)
        print(f"Conversation history reset: {args.history}")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README states that prompts and images are processed via the Wisdom Gate API, but it does not explicitly warn users that their text and uploaded images are transmitted to a third-party service. In an image-generation skill, users may supply sensitive personal photos or confidential visual material, so lack of disclosure can lead to unintended data exposure and privacy/compliance issues.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The README documents a hardcoded external API endpoint, confirming that skill data is transmitted off-host to a remote service. External transmission is expected for this skill's purpose, but it still carries security significance because prompts, images, and possibly derived metadata leave the local trust boundary.

Content

Scanner excerpt · README.md (reported line 172)May include surrounding context.

Endpoint:

text
https://api.wisgate.ai/v1beta/models/{model}:generateContent

Authentication (either header works):

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill documentation indicates capabilities that require environment access, file I/O, and outbound network use, but it does not declare any tool scope or permissions. This weakens reviewability and least-privilege controls, making it easier for a skill to access sensitive files, API keys, or transmit data externally without clear user or platform visibility.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger language is broad enough that the skill could activate on common image-related requests without the user realizing their content will be sent to an external service. In this context, unintended invocation matters because prompts and possibly local images may be transmitted off-platform, increasing privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill lacks a clear warning that user prompts and uploaded images are transmitted to an external API provider. This is dangerous because users may include sensitive personal, proprietary, or regulated content in prompts or source images without realizing that data leaves the local environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The skill explicitly uses an external endpoint, which means prompts, images, and associated metadata may be transmitted outside the local trust boundary. External transmission is expected for this skill's function, but it remains security-relevant because it creates privacy, confidentiality, and supply-chain exposure if not clearly declared and constrained.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

API Endpoint Format:

text
https://api.wisgate.ai/v1beta/models/{model}:generateContent

Authentication:

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

For text-to-image requests, the code silently enables a Google search tool by adding payload["tools"] = [{"google_search": {}}], but the skill metadata only describes image generation and editing. This creates an undisclosed data flow and capability expansion: user prompts may be used to trigger external search behavior that users and integrators would not reasonably expect from the manifest.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

An external search capability is enabled in an image-generation skill without any demonstrated need in the implementation or description. Because prompts may contain sensitive user content, enabling search broadens third-party processing and retrieval behavior beyond the minimum required for image generation, increasing privacy and policy risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script transmits user prompts and optional input images to a remote API, but there is no explicit warning, consent, or disclosure in the skill description about that data leaving the local environment. In the context of an image-editing skill, users may upload private images, making undisclosed third-party transmission materially more sensitive.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_image.py (reported line 77)May include surrounding context.

python
if not model:
        model = MODELS["nano-banana-pro"]["id"] if quality_priority else MODELS["nano-banana-2"]["id"]
    
    api_url = f"https://api.wisgate.ai/v1beta/models/{model}:generateContent"
    
    headers = {
        "x-goog-api-key": api_key,

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/refine_image.py (reported line 55)May include surrounding context.

python
if not model:
        model = MODELS["nano-banana-pro"]["id"] if quality_priority else MODELS["nano-banana-2"]["id"]
    
    api_url = f"https://api.wisgate.ai/v1beta/models/{model}:generateContent"
    
    headers = {
        "x-goog-api-key": api_key,

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_image.py (reported line 136)May include surrounding context.

python
print(f"Using model: {model}", file=sys.stderr)
    
    try:
        response = requests.post(api_url, headers=headers, json=payload, timeout=60)
        response.raise_for_status()
        result = response.json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/refine_image.py (reported line 81)May include surrounding context.

python
print(f"Using model: {model}", file=sys.stderr)
    
    try:
        response = requests.post(api_url, headers=headers, json=payload, timeout=60)
        response.raise_for_status()
        result = response.json()

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script sends the full conversation history, including prior user prompts and model responses, to a remote API on every refinement request without any explicit user warning, consent flow, or minimization. In an agent setting, prior turns may contain sensitive text, file-derived content, or operational context that users may not expect to be retransmitted to a third party.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README notes that conversation history is saved to JSON and can be resumed, but it does not warn that prompt history may persist locally on disk. This can expose sensitive prompts or workflow context to other local users, backups, source-control mistakes, or forensic recovery if operators assume the data is ephemeral.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documentation states the required environment variable is WISGATE_KEY at L062, but later the workflow says to check WISDOM_GATE_KEY at L139. This is an active documentation contradiction about how the skill is configured, which can cause users to provide credentials in the wrong place and fail to use the skill as described.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The module and CLI documentation say the tool generates images via Gemini models, but omit that some requests also enable Google search. While this is primarily a transparency issue rather than direct code execution risk, the omission can mislead users about where their prompts may go and what external capabilities are in use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.