ClawHub
Back to skill

Security audit

Nano Banana Pro Custom

Security checks for vulnerabilities and agentic risk

Overview

This image-generation skill is mostly purpose-aligned, but users should review it because it can upload prompts and images to any configured API endpoint and has weak credential-handling diagnostics.

Install only if you are comfortable sending prompts and any selected images to the configured API provider. Prefer environment variables or a managed OpenClaw secret/config path over a plaintext config.json, avoid putting extra secrets in this skill's config, and do not run --show-config where output may be logged until redaction is improved.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate_image.py:345
Finding

Configuration Inspection Can Expose Nested or Unrecognized Secrets

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/generate_image.py:2
Finding

Runtime Dependencies Are Dynamically Resolved Without Exact Pins or Integrity Locks

Content
View full analysis
=3.10" # dependencies = [ # "openai>=1.0.0", # "pillow>=10.0.0", # "requests>=2.28.0", # ] # /// ``` ### Technical Analysis The script declares only lower bounds for its three third-party packages. Under the documented `uv run` workflow, dependency resolution may select any current or future version satisfying these ranges. No exact version pins, committed lockfile, package hashes, or approved package-index restriction are present in the audited project. Consequently, execution is not reproducible and automatically extends trust to future releases from the configured package source. The package names are legitimate and no evidence of current typosquatting, dependency confusion, or an intentionally malicious package was found. The risk arises from unconstrained future resolution: a compromised upstream account, malicious future release, altered package index, or dependency-chain compromise could introduce code that executes during installation or import. ### Attack Path 1. An upstream package, transitive dependency, or configured package index is compromised, or publishes a malicious version that still satisfies the broad lower-bound constraint. 2. A user or Agent invokes the documented command through `uv run`. 3. The resolver selects and installs the malicious permitted version because no reviewed lockfile, exact pin, or integrity hash prevents it. 4. Malicious package code executes during installation or when imported by the script. 5. The payload runs with the same operating-system identity, filesystem access, environment, and network permissions as the Skill process. ### Impact Assessment Successful exploitation could provide arbitrary code execution within the privileges of the invoking Agent or user. ...[truncated 416 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

The skill allows the caller or local config to select an arbitrary external model provider via base_url and API key, which can redirect prompts and input images to untrusted services. In an image-editing skill that ingests local files, this materially increases exfiltration risk because sensitive visual data may be sent to a malicious or non-compliant endpoint.

Content

Scanner excerpt · scripts/generate_image.py (reported line 19)May include surrounding context.

python
Usage:
    # Generate new image
    uv run generate_image.py --prompt "a cat in space" --output "cat.png" \
        --base-url "https://api.example.com" --api-key "your-key" --model "gpt-image-1"

    # Edit with single image
    uv run generate_image.py --prompt "add a hat" --input dog.png --output "dog_hat.png" \

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill advertises capabilities that include environment-variable access, file reads, and network use, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens policy enforcement and user visibility, increasing the chance that the skill can access secrets or transmit data beyond what a caller expects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The natural-language instructions and usage guidance for the skill are presented almost entirely in Chinese, while the file does not state that the skill is region-specific or provide an opt-in language choice. This can violate organizational language/locale policy because it forces a specific language for users who may not understand it.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

The documentation instructs users to place an API key into a local config.json file inside the skill directory, which is often less protected than environment variables and can be accidentally committed, shared, or read by other local processes. Storing long-lived secrets in plaintext files materially increases credential exposure risk.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

md
# 创建配置文件
cat > {baseDir}/config.json << 'EOF'
{
  "baseUrl": "https://api.openai.com/v1",
  "apiKey": "your-api-key",
  "model": "gpt-image-1"
}

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

This example reinforces plaintext storage of apiKey in config.json, normalizing an insecure secret-handling pattern. If users follow it, credentials may be exposed through backups, source control, workspace sharing, or unintended file reads by the skill/runtime.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

json
{
  "baseUrl": "https://api.openai.com/v1",
  "apiKey": "your-api-key",
  "model": "gpt-image-1"
}

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_image.py (reported line 44)May include surrounding context.

python
{
        "skills": {
            "nano-banana-pro": {
                "baseUrl": "https://api.example.com/v1",
                "apiKey": "your-api-key",
                "model": "gpt-image-1"
            }

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_image.py (reported line 54)May include surrounding context.

python
{
        "skills": {
            "nano-banana-pro": {
                "baseUrl": "https://api.example.com/v1",
                "apiKey": "your-api-key",
                "model": "gpt-image-1"
            }

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/generate_image.py (reported line 52)May include surrounding context.

python
}

Configuration via skill config.json:
    Create ~/.openclaw/skills/nano-banana-pro/config.json:
    {
        "baseUrl": "https://api.example.com/v1",
        "apiKey": "your-api-key",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md
help="Input image path(s) for editing. Can be specified multiple times.",
    )
    parser.add_argument(
        "--base-url", help="API base URL (e.g., https://api.openai.com/v1)"
    )
    parser.add_argument("--api-key", help="API key")
    parser.add_argument("--model", help="Model name (default: gpt-image-1)")

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md
help="Input image path(s) for editing. Can be specified multiple times.",
    )
    parser.add_argument(
        "--base-url", help="API base URL (e.g., https://api.openai.com/v1)"
    )
    parser.add_argument("--api-key", help="API key")
    parser.add_argument("--model", help="Model name (default: gpt-image-1)")

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.

md
help="Input image path(s) for editing. Can be specified multiple times.",
    )
    parser.add_argument(
        "--base-url", help="API base URL (e.g., https://api.openai.com/v1)"
    )
    parser.add_argument("--api-key", help="API key")
    parser.add_argument("--model", help="Model name (default: gpt-image-1)")

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_image.py (reported line 268)May include surrounding context.

python
help="Input image path(s) for editing. Can be specified multiple times.",
    )
    parser.add_argument(
        "--base-url", help="API base URL (e.g., https://api.openai.com/v1)"
    )
    parser.add_argument("--api-key", help="API key")
    parser.add_argument("--model", help="Model name (default: gpt-image-1)")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script sends user prompts and, when provided, local input images to a remote API endpoint without a clear runtime warning or consent prompt. In this skill’s context, users may supply sensitive local images or proprietary prompts, and the configurable base_url means data could be transmitted to arbitrary third-party providers.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.