ClawHub
Back to skill

Security audit

Nano Banana Pro via cheaper grsai.com

Security checks across malware telemetry and agentic risk

Overview

This skill does what it advertises: generate or edit images through a third-party API, with some normal privacy and API-key handling cautions.

Use this only with prompts and images you are comfortable sending to grsaiapi.com. Prefer GRSAI_API_KEY over passing the key on the command line or in chat, and choose ordinary output filenames in your working directory to avoid overwriting important files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill directs the agent to use environment variables, read input images, write output files, and make network requests, yet it declares no permissions. This creates a mismatch between documented capabilities and the permission model, increasing the chance of unexpected file, secret, or network access without explicit user awareness or policy enforcement.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill explicitly tells users to supply an API key via a command-line argument, which can expose secrets through shell history, process listings, logs, or telemetry. Because this skill invokes a networked third-party API, leaking the key can lead to unauthorized API use and billing or account abuse.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal