seo-image-gen

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:02 AM UTC
• Version: 1.0.0

Overview

This SEO image-generation skill is mostly coherent, but it needs Review because it includes safety-filter workaround guidance and under-scoped external installer/API behavior.

Review before installing. Verify the Banana extension installer from a trusted source before running it, avoid running sudo or direct API commands through the agent, do not provide confidential prompts or brand assets unless you are comfortable sending them to Gemini/MCP services, and disregard the safety-filter workaround guidance rather than using it to preserve blocked intent.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:31

Finding

Execution of an Unverified Out-of-Package Installer

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31–33
Vulnerability Type: Insecure third-party dependency installation
Risk Level: Medium

Vulnerable Code

markdown

This skill requires the banana extension to be installed:
```bash
./extensions/banana/install.sh

text

The same command is recommended again in the error-handling guidance at lines 142 and 146–147:

```markdown
| MCP not configured | Run `./extensions/banana/install.sh` |
| MCP unavailable | Configure MCP with `./extensions/banana/install.sh`; seo-geo-skill does not vendor a local generation fallback script |
| Extension not installed | Show install instructions: `./extensions/banana/install.sh` |

Technical Analysis

The skill directs the user or executing agent to run a relative installer that is not included in the audited project. Consequently, this artifact provides no way to verify the script's contents, provenance, integrity, version, or resulting permissions.

The relative path is resolved according to the current working directory rather than a verified package root. If an attacker can create or replace ./extensions/banana/install.sh in that execution context, the documented command will execute attacker-controlled code while appearing to be the skill's legitimate installation procedure.

This creates a supply-chain trust gap: the skill depends on an external component but does not pin a release, verify a checksum or signature, or validate that the resolved installer belongs to the intended Banana extension.

Attack Path

1. An attacker gains write access to the workspace or otherwise controls the current working directory used when the skill runs.
2. The attacker creates or replaces ./extensions/banana/install.sh with a malicious script.
3. The Banana MCP tools are unavailable, causing the skill to present its prerequisite or error-handling instructions.
4. The user or agent follows the documented command without verifying the script's origin ...[truncated 907 chars]

Remediation

View remediation

Remediation Suggestions

1. Bundle the required installer within the reviewed package, or reference a specific official release from a trusted source.
2. Pin the dependency to an immutable version or commit rather than relying on an unspecified external installation.
3. Publish and verify a cryptographic checksum or signed release before execution.
4. Resolve the installer relative to a trusted, canonical package root instead of the current working directory.
5. Before running any installer, display its resolved absolute path and provenance and require explicit user approval.
6. Validate ownership and permissions and reject scripts located in writable or unexpected directories.
7. Document exactly what the installer changes, which packages it installs, and which credentials or permissions it requires.
8. Apply the corrected installation procedure consistently to the repeated guidance at SKILL.md:142 and SKILL.md:146–147.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence

Findings (20)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document explicitly teaches users to rephrase blocked prompts so they can pass safety filters, including shifting wording while preserving the underlying restricted intent. That is dangerous because it operationalizes safety-evasion behavior and can help generate content that platform safeguards were designed to stop.

Content

No source excerpt is available for this finding.

Ssd 1

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This guidance explicitly recommends semantic reframing to get around server-side safety restrictions, even noting that the path forward after blocking is rephrasing. In the context of an image-generation skill, that makes the skill materially more dangerous because it can be used to convert disallowed requests into superficially acceptable prompts that still pursue the same prohibited outcome.

Content

No source excerpt is available for this finding.

Ssd 2

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The examples provide concrete paraphrases for violence, medical, celebrity, minors, and suggestive content that could help evade simple detection patterns and moderation heuristics. Even if presented as usability advice, these examples serve as reusable bypass templates and lower the effort required to probe or circumvent safeguards.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest includes a very broad set of trigger phrases such as generic requests like "banner," "thumbnail," "generate visual," and "create visual," which can cause the skill to activate in situations broader than the user intended. In a skill that invokes external image-generation tooling and may incur cost or transmit user-provided content to a third-party MCP service, unintended invocation increases the risk of unnecessary data exposure, unwanted actions, and surprise spend.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill directs the agent to send image descriptions and prompts to external MCP tools backed by Gemini, but it does not prominently warn that user inputs may be shared with third-party services. In practice, users may provide sensitive marketing plans, unreleased product details, or proprietary brand assets in prompts, so the lack of an explicit privacy/data-sharing notice creates a real confidentiality and consent risk.

Content

No source excerpt is available for this finding.

Indirect Prompt Extraction

Medium

• Category: System Prompt Leakage
• Confidence: 75% confidence

Finding

Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

md

| MCP not configured | Run `./extensions/banana/install.sh` |
| API key invalid | New key at https://aistudio.google.com/apikey |
| Rate limited (429) | Wait 60s, retry. Free tier: ~10 RPM / ~500 RPD |
| `IMAGE_SAFETY` | Rephrase prompt - see `references/prompt-engineering.md` Safety section |
| MCP unavailable | Configure MCP with `./extensions/banana/install.sh`; seo-geo-skill does not vendor a local generation fallback script |
| Extension not installed | Show install instructions: `./extensions/banana/install.sh` |

Indirect Prompt Extraction

Medium

• Category: System Prompt Leakage
• Confidence: 75% confidence

Finding

Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Content

Scanner excerpt · references/gemini-models.md (reported line 182)May include surrounding context.

md

| MCP not configured | Run `./extensions/banana/install.sh` |
| API key invalid | New key at https://aistudio.google.com/apikey |
| Rate limited (429) | Wait 60s, retry. Free tier: ~10 RPM / ~500 RPD |
| `IMAGE_SAFETY` | Rephrase prompt - see `references/prompt-engineering.md` Safety section |
| MCP unavailable | Configure MCP with `./extensions/banana/install.sh`; seo-geo-skill does not vendor a local generation fallback script |
| Extension not installed | Show install instructions: `./extensions/banana/install.sh` |

Indirect Prompt Extraction

Medium

• Category: System Prompt Leakage
• Confidence: 75% confidence

Finding

Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Content

Scanner excerpt · references/gemini-models.md (reported line 184)May include surrounding context.

md

| MCP not configured | Run `./extensions/banana/install.sh` |
| API key invalid | New key at https://aistudio.google.com/apikey |
| Rate limited (429) | Wait 60s, retry. Free tier: ~10 RPM / ~500 RPD |
| `IMAGE_SAFETY` | Rephrase prompt - see `references/prompt-engineering.md` Safety section |
| MCP unavailable | Configure MCP with `./extensions/banana/install.sh`; seo-geo-skill does not vendor a local generation fallback script |
| Extension not installed | Show install instructions: `./extensions/banana/install.sh` |

Indirect Prompt Extraction

Medium

• Category: System Prompt Leakage
• Confidence: 75% confidence

Finding

Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Content

Scanner excerpt · references/gemini-models.md (reported line 185)May include surrounding context.

md

| MCP not configured | Run `./extensions/banana/install.sh` |
| API key invalid | New key at https://aistudio.google.com/apikey |
| Rate limited (429) | Wait 60s, retry. Free tier: ~10 RPM / ~500 RPD |
| `IMAGE_SAFETY` | Rephrase prompt - see `references/prompt-engineering.md` Safety section |
| MCP unavailable | Configure MCP with `./extensions/banana/install.sh`; seo-geo-skill does not vendor a local generation fallback script |
| Extension not installed | Show install instructions: `./extensions/banana/install.sh` |

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The reference expands the skill from simple image generation into broader stateful visual chat, history retrieval, context persistence, and model switching. That scope expansion can cause an agent to use capabilities the skill did not clearly declare, increasing the chance of unintended data exposure, persistence across turns, or actions outside the user's expectation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document explicitly suggests bypassing the declared MCP-based skill boundary by using direct API calls with curl or the Google AI SDK. In an agent setting, that creates a path for unsanctioned network access, custom request construction, and possible misuse of credentials or unsupported features outside the reviewed tool perimeter.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest describes a skill for generating SEO images via Gemini, but this reference file instructs the agent to check for and install external command-line tools like ImageMagick and FFmpeg. Shell-based local tool usage and package installation are not an obvious requirement of merely generating images, and expand the skill into local image/video manipulation and environment setup.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 78% confidence

Finding

The documentation explicitly recommends a sudo-based package installation command. In an agent or semi-automated environment, normalizing privileged shell execution increases the chance that a model or user will run commands with elevated permissions unnecessarily, expanding the blast radius of mistakes or downstream command manipulation.

Content

Scanner excerpt · references/post-processing.md (reported line 14)May include surrounding context.

which ffmpeg # For video/animation

text

Install ImageMagick if not present: `sudo apt install imagemagick` (Debian/Ubuntu) or `brew install imagemagick` (macOS).

## Common Operations

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest scope is image generation for SEO assets such as OG images, hero images, and product photography. The reference adds GIF and MP4 slideshow generation using multiple frames, which is a distinct media-production capability not clearly supported by the stated image-generation purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Lines L020-L021 state that every image prompt should be written as natural narrative paragraphs and 'NEVER' as comma-separated keyword lists. This imposes a fixed language/style requirement rather than offering alternatives or letting the user choose their preferred prompting format.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This section expands the skill from static prompt-engineering guidance into live web/search-grounded content retrieval and analysis. In an image-generation skill, that increases scope and can enable unvetted external data use, potentially causing prompt injection, misleading outputs, or policy circumvention through fetched live content.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/seo-image-presets.md (reported line 124)May include surrounding context.

md

## Creating Custom Presets

Users can create their own presets with the installed Banana MCP preset tool.
If the standalone Banana extension is not installed, configure it before using
custom presets. The core seo-geo-skill skill does not assume a local fallback
script or a fixed personal configuration directory.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The selection logic says to load presets if the user 'specifies a use case command' or 'mentions a brand preset name', but it does not define exact trigger phrases, scope boundaries, or exclusion cases. In a markdown skill reference, this ambiguity can cause unintended preset activation from ordinary discussion of OG images, hero images, or brand names.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation states that generated images are saved to the user's Documents directory without warning about local file creation or retention. In this skill context, silent writes are a real security and privacy concern because generated assets may contain sensitive or proprietary content and persist on disk unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

Listing a required API key without any security guidance encourages casual handling of credentials in an agent workflow. This is risky because users or maintainers may expose the key in logs, prompts, shell history, or documentation while configuring the skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.