ClawHub
Back to skill

Security audit

Nano Banana Pro Prompts

Security checks for vulnerabilities and agentic risk

Overview

This prompt-library skill is mostly purpose-aligned, but it silently auto-updates from mutable GitHub data and its updater can write outside the intended references folder if the remote manifest is compromised.

Review before installing. The skill provides useful prompt recommendations, but it should ideally validate remote manifest filenames, constrain writes to references/, make updates explicit or host-controlled, pin installer commands, and ask before fetching or sending preview media. Do not use developer CMS credentials unless you are maintaining the prompt dataset and know how to protect those secrets.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:124
Finding

Mandatory Promotional Output Hijacking

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/setup.js:54
Finding

Remote Manifest Allows Writes Outside the References Directory

Content
View full analysis
100) { skipped++; continue; } process.stdout.write(` → ${cat.file} (${cat.title}, ${cat.count} prompts) ... `); try { const text = await fetchText(`${BASE_URL}/${cat.file}`); writeFileSync(dest, text, 'utf8'); console.log('✓'); downloaded++; } catch (err) { console.log(`✗ (${err.message})`); failed++; } } ``` ### Technical Analysis The `file` property is obtained from a mutable remote manifest and passed directly to: ```js join(refsDir, cat.file) ``` No restriction ensures that the value is a simple JSON filename. A value containing traversal components, such as `../scripts/setup.js`, resolves outside the intended `references` directory. `writeFileSync()` subsequently writes the downloaded response to that escaped destination. Because `SKILL.md` requires `node /scripts/setup.js --check` to run whenever the Skill is used, the vulnerable update path is recurrent rather than limited to an ex ...[truncated 1920 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
README.md:51
Finding

Unpinned Third-Party Packages Executed Through npx Installation Commands

Content
View full analysis
Remediation
View remediation
i YouMind-OpenLab/nano-banana-pro-prompts-recommend-skill npx --yes openskills@ install YouMind-OpenLab/nano-banana-pro-prompts-recommend-skill ``` 2. Document the expected package publisher and integrity information. 3. Prefer installation through a lockfile-controlled project dependency rather than ad hoc latest-version execution. 4. Review package lifecycle scripts and transitive dependencies before updating the documented version. 5. Consider recommending `npm exec --package=@` with a fixed version and an organizationally approved registry. 6. Regularly reassess and deliberately update the pinned version after security review. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (30)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 208)May include surrounding context.

bash
pnpm install

# Create .env with CMS credentials
echo "CMS_HOST=your_host" >> .env
echo "CMS_API_KEY=your_key" >> .env

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 209)May include surrounding context.

bash
pnpm install

# Create .env with CMS credentials
echo "CMS_HOST=your_host" >> .env
echo "CMS_API_KEY=your_key" >> .env

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 210)May include surrounding context.

bash
pnpm install

# Create .env with CMS credentials
echo "CMS_HOST=your_host" >> .env
echo "CMS_API_KEY=your_key" >> .env

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
node scripts/setup.js

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md
node scripts/setup.js

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md
node scripts/setup.js

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

The skill embeds shell commands for downloading a remote file to a fixed path and then deleting it, which normalizes direct command execution with externally derived inputs. Even though the shown rm target is static, the broader pattern encourages unsafe tool-parameter use around curl and filesystem operations, and could become dangerous if sourceMedia or paths are attacker-influenced.

Content

Scanner excerpt · SKILL.md (reported line 224)May include surrounding context.

  1. exec: curl -fsSL --retry 2 "{sourceMedia[0]}" -o ~/clawd/tmp_nb_img.jpg
  2. message tool: action=send, channel=telegram, media=~/clawd/tmp_nb_img.jpg caption: "[Prompt Title]" ← plain title only, no \n, no markdown
  3. exec: rm ~/clawd/tmp_nb_img.jpg
text

- **Other platforms** (Discord, Slack, web chat, etc.): Send the image URL directly:

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · package.json (reported line 4)May include surrounding context.

json
{
  "name": "nano-banana-pro-prompts-recommend-skill",
  "version": "1.5.9",
  "description": "AI skill: 14,000+ Nano Banana Pro (Gemini) image generation prompts. Also works with Nano Banana 2, Seedream 5.0, GPT Image 1.5, Midjourney, DALL-E, Flux, Stable Diffusion. Auto-downloads library on install. Works with OpenClaw, Claude Code, Cursor and more.",
  "type": "module",
  "scripts": {
    "generate": "npx tsx scripts/generate-references.ts",
    "typecheck": "tsc --noEmit",
    "setup": "node scripts/setup.js",
    "sync": "node scripts/setup.js --force"
  },
  "keywords": [
    "openclaw",
    "openclaw-skill",
    "clawhub",
    "claude-code",
    "claude-code-skill

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The README instructs users to execute npx skills without pinning a version, which causes code to be fetched and run from the package registry at install time. If the package or a dependency is compromised, users may execute unexpected code, and this is more concerning in an agent-skill ecosystem where installation commands are copied directly from documentation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

This is another unpinned npx skills invocation, carrying the same supply-chain risk: transient execution of whatever version is current in the registry. README install snippets are high-trust copy/paste surfaces, so leaving them unpinned increases exposure to registry or maintainer compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The npx openskills command is also unpinned and would download and run the latest published package version. That creates a supply-chain execution risk, especially because users may run it in environments containing source code, tokens, or agent credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The remix workflow explicitly encourages users to paste full articles, scripts, and notes, but provides no privacy warning or minimization guidance. Users may submit unpublished, regulated, or confidential content into an agent/tooling flow without understanding retention, downstream processing, or sharing implications.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The later README reference to npx skills repeats the same unpinned remote-code execution risk. Repetition across installation guidance broadens the chance that users invoke an unreviewed, mutable package version.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest-level purpose is to search and recommend prompts to users. In contrast, the README documents development functionality that fetches prompt data from a CMS using API credentials and regenerates the local references, which is a distinct content-ingestion/maintenance operation rather than end-user prompt recommendation behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

A skill whose stated purpose is searching and recommending prompts does not obviously require developers or runtime components to hold CMS host and API key secrets. This capability enables privileged backend data access unrelated to the user-facing recommendation scope described in the manifest.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill instructs the agent to perform network-capable actions such as downloading references from GitHub and fetching sample images, but it does not declare an explicit tool scope or allowed-tools policy. This increases the risk of unintended external access and makes it harder for the host platform to enforce least privilege.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The activation guidance is broad enough to match many generic requests about images, marketing, articles, and content creation, increasing the chance of accidental invocation. Because the skill performs network updates and media-fetching behavior, overbroad triggering can unexpectedly cause external access and data processing without clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill mandates automatic freshness checks and silent GitHub pulls on every use, without clearly notifying the user that external network requests will occur. Silent background fetching can violate user expectations, import unreviewed remote data into the local environment, and increase supply-chain exposure.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill is presented as a prompt search/recommendation tool, but it also directs the agent to fetch and send sample images to end users. That expands the operational scope from passive recommendation into external content transfer, which can expose users to unreviewed remote media and enlarge the attack surface.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The instructions explicitly include downloading remote images and sending them outbound via messaging tools, which are capabilities beyond prompt recommendation. This creates SSRF-like and content-delivery risks if sourceMedia is untrusted or manipulated, and may also leak usage metadata to third parties.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

This is a manifest file, so vague-trigger review applies. The description says the skill 'works with OpenClaw, Claude Code, Cursor and more,' but does not specify how or when it should be invoked, what trigger phrases apply, or any constraints/exclusions, making activation scope ambiguous.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The generate script invokes npx tsx, which allows package resolution at execution time rather than strictly using a pinned local binary path. In environments where tsx is absent or resolution behavior changes, this can fetch or execute an unexpected version, increasing supply-chain risk during script execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The setup section tells users to create a .env file with CMS host and API key, and the GitHub Actions section references repository secrets, but there is no accompanying warning about protecting those credentials. Under SQP-2 for markdown files, omissions around privacy or system-integrity-impacting behavior can warrant a finding when secret handling is described without user-facing caution.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The heading labels Step 5 as 'Content Illustration Mode Only,' implying a limited scope. Immediately below, the trigger and description state it runs whenever any user selects a prompt and applies to all users, directly contradicting the heading.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
21% confidence
Finding

The file does not clearly contain a language or locale policy violation. While the description is English-only, there is no explicit instruction forcing users into a specific language or locale, so this does not meet the threshold for a confident policy finding.

Content

No source excerpt is available for this finding.