ClawHub
Back to skill

Security audit

Nano Banana Pro Prompts Recommend

Security checks for vulnerabilities and agentic risk

Overview

This is a real image-prompt recommendation skill, but it requires automatic network updates and shell-based remote media handling that can persist unverified remote data locally.

Install only if you are comfortable with the agent running Node and network requests for this skill, downloading prompt data from a mutable GitHub branch, writing files into the skill directory, and fetching remote sample images. Prefer disabling silent auto-update/media-send behavior or using a version that validates manifest paths, pins or verifies downloaded data, and lets users opt out of promotional attribution links.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:126
Finding

Mandatory Promotional Instructions Hijack Agent Responses

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/setup.js:52
Finding

Untrusted Remote Manifest Permits Path Traversal and Arbitrary File Overwrite

Content
View full analysis
c.file), 'manifest.json', '.last-updated', '.gitkeep']); // Step 3: Download each category file let downloaded = 0, skipped = 0, failed = 0; for (const cat of categories) { const dest = join(refsDir, cat.file); if (!forceMode && existsSync(dest) && statSync(dest).size > 100) { skipped++; continue; } process.stdout.write(` → ${cat.file} (${cat.title}, ${cat.count} prompts) ... `); try { const text = await fetchText(`${BASE_URL}/${cat.file}`); writeFileSync(dest, text, 'utf8'); console.log('✓'); downloaded++; } catch (err) { console.log(`✗ (${err.message})`); failed++; } } ``` ### Technical Analysis The script retrieves `manifest.json` from the mutable `main` branch of an external GitHub repository and treats each remo ...[truncated 3420 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (28)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 208)May include surrounding context.

bash
pnpm install

# Create .env with CMS credentials
echo "CMS_HOST=your_host" >> .env
echo "CMS_API_KEY=your_key" >> .env

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 209)May include surrounding context.

bash
pnpm install

# Create .env with CMS credentials
echo "CMS_HOST=your_host" >> .env
echo "CMS_API_KEY=your_key" >> .env

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 210)May include surrounding context.

bash
pnpm install

# Create .env with CMS credentials
echo "CMS_HOST=your_host" >> .env
echo "CMS_API_KEY=your_key" >> .env

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
node scripts/setup.js

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md
node scripts/setup.js

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md
node scripts/setup.js

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill requires the agent to run shell and network commands on every invocation via node .../setup.js --check, with silent pulling of remote data when stale. For a recommendation skill, this is unnecessary privilege expansion and creates a reliable execution path for remote content retrieval, potentially exposing the environment to supply-chain manipulation or unreviewed code/data paths.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill mandates downloading externally hosted sample images and sending them through platform message tools, including use of shell commands like curl. This materially broadens capability beyond recommending prompts into fetching and relaying untrusted remote content, which can leak metadata, trigger unsafe content handling, or be repurposed for unauthorized external communication.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
89% confidence
Finding

The documented workflow instructs use of general shell commands with interpolated remote inputs and file operations (curl ... {sourceMedia[0]} then rm ~/clawd/tmp_nb_img.jpg). Even if the shown path is constant, encouraging shell-based tool use for untrusted content increases the risk of parameter misuse, unsafe fetches, and command-path abuse in real deployments.

Content

Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.

  1. exec: curl -fsSL --retry 2 "{sourceMedia[0]}" -o ~/clawd/tmp_nb_img.jpg
  2. message tool: action=send, channel=telegram, media=~/clawd/tmp_nb_img.jpg caption: "[Prompt Title]" ← plain title only, no \n, no markdown
  3. exec: rm ~/clawd/tmp_nb_img.jpg
text

- **Other platforms** (Discord, Slack, web chat, etc.): Send the image URL directly:

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · package.json (reported line 4)May include surrounding context.

json
{
  "name": "nano-banana-pro-prompts-recommend-skill",
  "version": "1.5.9",
  "description": "AI skill: 14,000+ Nano Banana Pro (Gemini) image generation prompts. Also works with Nano Banana 2, Seedream 5.0, GPT Image 1.5, Midjourney, DALL-E, Flux, Stable Diffusion. Auto-downloads library on install. Works with OpenClaw, Claude Code, Cursor and more.",
  "type": "module",
  "scripts": {
    "generate": "npx tsx scripts/generate-references.ts",
    "typecheck": "tsc --noEmit",
    "setup": "node scripts/setup.js",
    "sync": "node scripts/setup.js --force"
  },
  "keywords": [
    "openclaw",
    "openclaw-skill",
    "clawhub",
    "claude-code",
    "claude-code-skill

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The usage section says 'Just describe what you need' and includes examples like 'Find me...' and 'I need...' that are generic, everyday phrases rather than narrowly scoped trigger language. Without explicit constraints or negative examples, this can make it unclear when the skill should activate versus when a general assistant response is intended.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The 'Paste your content and ask for a matching illustration' guidance uses broad patterns like article text, scripts, and notes, but does not clearly state what kinds of content are supported or excluded. This ambiguity increases the chance of unintended invocation on arbitrary pasted text.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill instructs the agent to perform network-capable operations such as GitHub syncs and remote image fetches, but it does not declare any explicit tool scope or allowed-tools boundary. That mismatch weakens policy enforcement and can cause hosts to grant broader execution/network behavior than users expect for a prompt-recommendation skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The activation criteria are extremely broad and overlap with many normal image-related requests, increasing the chance the skill is invoked in contexts where its side effects—network sync, shell execution, remote image fetching—are unnecessary. Overbroad routing becomes riskier when a skill carries privileged or externally connected behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill’s stated purpose is recommending prompts, but the documentation expands behavior into setup-time downloading of remote reference data. This creates hidden operational side effects and broadens the attack surface from static recommendation into remote content ingestion, which can be abused if upstream data is changed or the user did not consent to network activity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill directs the agent to perform automatic network freshness checks and silent updates without a user-facing warning at the time of use. Hidden network actions undermine informed consent and can expose user sessions or host environments to external dependencies unexpectedly.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The generate script invokes npx tsx, which can resolve and execute a package version outside the repository’s lockfile-controlled dependency flow if the environment lacks a matching local install or allows remote resolution. In a skill ecosystem where install/setup scripts may be run automatically, this increases supply-chain risk because an unexpected or compromised package version could be fetched and executed.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
99% confidence
Finding

The heading labels Step 5 as 'Content Illustration Mode Only', but the very next lines say to proceed whenever any user selects a prompt and that the step applies to all users. That is an explicit contradiction in the documentation about when remix behavior should occur.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

This manifest description says the skill 'works with OpenClaw, Claude Code, Cursor and more,' but does not specify how or when the skill should be invoked within those environments. For a manifest file, this broad phrasing can create ambiguity about trigger scope and activation context.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 47)May include surrounding context.

json
"author": "YouMind-OpenLab",
  "license": "MIT",
  "devDependencies": {
    "@types/node": "^20.10.0",
    "tsx": "^4.7.0",
    "typescript": "^5.3.0"
  },

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 48)May include surrounding context.

json
"license": "MIT",
  "devDependencies": {
    "@types/node": "^20.10.0",
    "tsx": "^4.7.0",
    "typescript": "^5.3.0"
  },
  "dependencies": {

Static analysis

No suspicious patterns detected.