ClawHub
Back to skill

Security audit

Evolink Nano Banana 2 1

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Evolink image-generation integration, with expected third-party API use and temporary public image hosting.

Before installing, use a dedicated Evolink API key, verify or pin the external MCP npm package if you use it, and avoid uploading confidential images or prompts unless you are comfortable sending them to Evolink and exposing temporary public links.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The documentation explicitly instructs users to upload images and then states that the returned `file_url` is a publicly accessible link, but it does not prominently warn that uploaded content becomes accessible to anyone with the URL. In a skill handling user-provided images, this creates a real risk of accidental disclosure of sensitive or private images because users may assume ordinary file upload semantics rather than public hosting.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Content
- **MCP tools + API key ready:** "Hi! Nano Banana 2 is ready — Google's fast image model at your fingertips. What would you like to create?"
- **MCP tools + no API key:** "You'll need an EvoLink API key — sign up at evolink.ai. Ready to go?"
- **No MCP tools:** "MCP server isn't connected yet. Want me to help set it up? I can still manage files via the hosting API."

Keep the greeting concise — just one question to move forward.
Confidence
70% confidence
Finding
tools:*

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.