Create PPT with Nano Banana Pro

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:13 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward presentation-generation helper, with disclosed external tools and a normal dependency install, but users should note its Chinese-first output style and unpinned npm package.

Install in a normal least-privileged project environment, consider pinning pptxgenjs in a package.json/lockfile before repeat use, and expect the skill to produce Chinese-first slide content unless you override that in your request.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:132

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 132–137
Vulnerability Type: Supply-chain risk from unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

bash

# Install required packages
npm install pptxgenjs

# For nano-banana-pro (if using locally)
# Ensure uv and nano-banana-pro skill are configured

Technical Analysis

The skill directs users to install pptxgenjs without specifying an exact audited version or requiring a lockfile. Consequently, the command resolves mutable package and transitive-dependency versions from the configured npm registry at installation time.

The skill also relies on a separately configured nano-banana-pro component without documenting a pinned version, verified source, or integrity value. Although the audited project does not contain malicious executable code, these installation and configuration instructions create a supply-chain trust boundary outside the reviewed artifact.

A compromised package release, transitive dependency, registry, or package-manager configuration could introduce attacker-controlled code. npm lifecycle scripts may execute during installation under the privileges of the user running npm.

Attack Path

1. An attacker compromises a referenced package, one of its transitive dependencies, its publishing account, or the configured package registry.
2. The attacker publishes a malicious version or serves modified package content.
3. A user follows the documented npm install pptxgenjs instruction without a locked dependency graph or verified integrity metadata.
4. npm resolves and downloads the attacker-controlled package content.
5. Malicious lifecycle code executes during installation, or malicious library behavior runs when the generated presentation script imports pptxgenjs.
6. The payload operates with the privileges and accessible resources of the installing or executing user.

The same general trust risk applies to the separately configured ...[truncated 704 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin pptxgenjs to an exact version that has been reviewed, rather than resolving the latest compatible registry release.
2. Commit a package manifest and lockfile, and require reproducible installation with npm ci.
3. Verify lockfile integrity metadata and use a trusted, explicitly configured npm registry.
4. Audit direct and transitive dependencies with appropriate software-composition analysis and vulnerability scanning.
5. Disable lifecycle scripts during installation where they are unnecessary, for example with npm ci --ignore-scripts, after confirming that this does not break required functionality.
6. Pin nano-banana-pro to a reviewed version and document its authoritative source, integrity verification process, permissions, and data-handling behavior.
7. Run dependency installation and presentation generation in a least-privileged, isolated environment without unnecessary credentials or access to sensitive files.
8. Establish a controlled dependency-update process that reviews version changes before updating the lockfile.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The markdown explicitly states 'Chinese Content First' and requires 'All content in Chinese as primary language.' This is a natural-language locale policy constraint that applies globally to the skill, but the file does not offer opt-in, alternatives, or a documented region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The template instructs that 'All text in Chinese with English notes in parentheses where appropriate,' which hard-codes a language preference into operational instructions. Because no user choice or justified regional constraint is provided, this conflicts with the policy against forcing a specific language.

Content

No source excerpt is available for this finding.