ClawHub
Back to skill

Security audit

Poyo Nano Banana 2

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but its helper script handles the PoYo API key in a way that can expose the credential to local process inspection.

Review this before installing if the PoYo API key has billing or quota impact. Prefer not to pass the key as a command-line argument, avoid using the helper on shared or heavily monitored machines, and only submit prompts, image URLs, and callback URLs that you are comfortable sending to PoYo.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/submit_nano_banana_2.sh:10
Finding

PoYo API Key Exposed Through Process Command-Line Arguments

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (9)

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1)May include surrounding context.

md
---
name: poyo-nano-banana-2
description: Nano Banana 2 image generation and advanced editing on PoYo / poyo.ai via `https://api.poyo.ai/api/generate/submit`; use for `nano-banana-2-new`, `nano-banana-2-new-edit`, multi-reference workflows, text-to-image, image-to-image, and 1K/2K/4K output.
metadata: {"openclaw":{"homepage":"https://poyo.ai/models/nano-banana-2","requires":{"bins":["curl"],"env":["POYO_API_KEY"]},"primaryEnv":"POYO_API_KEY"}}

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api.md (reported line 19)May include surrounding context.

Content-Type: application/json

text

Get API keys from <https://poyo.ai/dashboard/api-key>.

Recommended skill env var:

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The skill explicitly instructs use of an external API endpoint and requires an API key, meaning prompts and any referenced image URLs may be transmitted to a third-party service. In this context that is expected functionality, but it is still a real security/privacy concern because users may unintentionally send sensitive data off-platform to poyo.ai.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: poyo-nano-banana-2
description: Nano Banana 2 image generation and advanced editing on PoYo / poyo.ai via `https://api.poyo.ai/api/generate/submit`; use for `nano-banana-2-new`, `nano-banana-2-new-edit`, multi-reference workflows, text-to-image, image-to-image, and 1K/2K/4K output.
metadata: {"openclaw":{"homepage":"https://poyo.ai/models/nano-banana-2","requires":{"bins":["curl"],"env":["POYO_API_KEY"]},"primaryEnv":"POYO_API_KEY"}}
---

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 5)May include surrounding context.

md
## Endpoint

- Submit task: `POST https://api.poyo.ai/api/generate/submit`
- Status query: see PoYo unified task status docs at <https://docs.poyo.ai/api-manual/task-management/status>
- Model page: <https://poyo.ai/models/nano-banana-2>
- Source docs: <https://docs.poyo.ai/api-manual/image-series/nano-banana-2-new>

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 49)May include surrounding context.

md
## Endpoint

- Submit task: `POST https://api.poyo.ai/api/generate/submit`
- Status query: see PoYo unified task status docs at <https://docs.poyo.ai/api-manual/task-management/status>
- Model page: <https://poyo.ai/models/nano-banana-2>
- Source docs: <https://docs.poyo.ai/api-manual/image-series/nano-banana-2-new>

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 65)May include surrounding context.

md
## Endpoint

- Submit task: `POST https://api.poyo.ai/api/generate/submit`
- Status query: see PoYo unified task status docs at <https://docs.poyo.ai/api-manual/task-management/status>
- Model page: <https://poyo.ai/models/nano-banana-2>
- Source docs: <https://docs.poyo.ai/api-manual/image-series/nano-banana-2-new>

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 49)May include surrounding context.

Submission example

bash
curl -sS https://api.poyo.ai/api/generate/submit \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The hardcoded external endpoint confirms that this skill is designed to send data outside the local environment to api.poyo.ai. Even if legitimate, this is security-relevant because the payload source is arbitrary and the script provides no boundary checks, trust validation beyond default TLS, or approval gate before exfiltrating file contents.

Content

Scanner excerpt · scripts/submit_nano_banana_2.sh (reported line 26)May include surrounding context.

sh
payload_file="$2"
fi

curl -sS https://api.poyo.ai/api/generate/submit \
  -H "Authorization: Bearer ${api_key}" \
  -H 'Content-Type: application/json' \
  --data @"${payload_file}"

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The hardcoded external endpoint confirms that this skill is designed to send data outside the local environment to api.poyo.ai. Even if legitimate, this is security-relevant because the payload source is arbitrary and the script provides no boundary checks, trust validation beyond default TLS, or approval gate before exfiltrating file contents.

Content

Scanner excerpt · scripts/submit_nano_banana_2.sh (reported line 26)May include surrounding context.

sh
payload_file="$2"
fi

curl -sS https://api.poyo.ai/api/generate/submit \
  -H "Authorization: Bearer ${api_key}" \
  -H 'Content-Type: application/json' \
  --data @"${payload_file}"

Static analysis

No suspicious patterns detected.