ClawHub
Back to skill

Security audit

Poyo Nano Banana 2

Security checks across malware telemetry and agentic risk

Overview

The skill appears coherent and clean overall, with a privacy caution around guidance that may require making user images reachable by an external API.

Install is reasonable if you are comfortable with image API workflows. When using it with real user images, avoid public links for private or personal content; use short-lived signed URLs or private storage, get consent, and delete temporary uploads when finished.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The note explicitly instructs users to upload local user images to a reachable/public location before sending them to the API, but it omits any privacy, access-control, retention, or consent guidance. That can lead operators to expose sensitive user images through publicly accessible URLs or third-party hosting, creating unnecessary data disclosure risk even if the image-generation flow itself requires remote URLs.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.