Nano Banana Pro

• Verdict: Pass
• Analyzed: May 12, 2026, 4:23 AM
• Findings: 0
• Version: 1.0.0
• Hash: a5e15371d3534bbbcbf8936f313432ad5b0f9ba3d62abd4264861e5191898114
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: bex-nano-banana-pro Version: 1.0.0 The `generate.py` script is vulnerable to path traversal via the `--output` argument. The `urllib.request.urlretrieve` function writes the downloaded image to the path specified by `args.output` without any sanitization or validation. This allows a malicious user or a compromised agent to specify a path like `../../evil.sh`, potentially writing files to arbitrary locations outside the skill's intended workspace. This is a significant vulnerability (lack of input sanitization) that could lead to arbitrary file writes, classifying the skill as suspicious rather than benign.