Nano Banana Pro OpenRouter

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:16 AM UTC
• Version: 1.0.1

Overview

The skill appears to generate images as advertised, but it handles local API secrets in ways users should review before installing.

Review this before installing if you keep secrets in project .env files. Use a dedicated limited OpenRouter key, verify OPENROUTER_BASE_URL points to the intended OpenRouter endpoint, and avoid running it from directories whose .env files may contain unrelated or untrusted values.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill clearly instructs the agent to execute shell commands, but no declared permissions are documented in the manifest. That mismatch weakens reviewability and can cause the skill to run with capabilities users or auditors did not explicitly expect.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to read a local .env file and extract API credentials, which exceeds a narrow image-generation instruction set and moves into secret retrieval. In this context, the danger is increased because the skill operationalizes credential access and reuse from local storage without explicit user confirmation.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The script implicitly loads secrets and configuration from $PWD/.env and the skill-local .env before using explicit environment variables, which broadens the trust boundary and can cause unreviewed local files to influence credential selection and network destinations. In an agent context, this is risky because execution may occur in directories controlled by users or other tools, enabling accidental credential pickup or redirection to an attacker-controlled endpoint.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: Passing API credentials on the command line is dangerous because process arguments may be exposed via process listings, logs, shell history, telemetry, or error reporting. The absence of any warning or mitigation makes accidental disclosure of the OpenRouter key materially more likely.

Ssd 3

High

• Confidence: 99% confidence
• Finding: These instructions explicitly direct the agent to read secrets from a local .env file and then reuse them in command arguments. That creates a direct secret-handling path that can leak credentials through command invocation surfaces and normalizes unauthorized secret access by the skill.

External Transmission

Medium

• Category: Data Exfiltration

Content

response_file=$(mktemp)
trap 'rm -f "$response_file"' EXIT

if ! http_code=$(curl -sS -o "$response_file" -w "%{http_code}" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $api_key" \
  -d "$payload" \

• Confidence: 77% confidence
• Finding: curl -sS -o "$response_file" -w "%{http_code}" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $api_key" \ -d "$payload" \ "$base_url"); then echo "Error: Request failed."

Credential Access

High

• Category: Privilege Escalation

Content

The API base URL must be set via OPENROUTER_BASE_URL. Use the full chat
completions endpoint (for OpenRouter: `https://openrouter.ai/api/v1/chat/completions`).

The script also loads .env files automatically (if present):
- Current working directory .env
- Skill directory .env

• Confidence: 93% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

completions endpoint (for OpenRouter: `https://openrouter.ai/api/v1/chat/completions`).

The script also loads .env files automatically (if present):
- Current working directory .env
- Skill directory .env

Important: If a .env file exists, do not ask the user for the key up front.

• Confidence: 93% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

The script also loads .env files automatically (if present):
- Current working directory .env
- Skill directory .env

Important: If a .env file exists, do not ask the user for the key up front.
Just run the script and only ask if it errors with "No API key provided."

• Confidence: 93% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

- Current working directory .env
- Skill directory .env

Important: If a .env file exists, do not ask the user for the key up front.
Just run the script and only ask if it errors with "No API key provided."

### OpenClaw Chat Execution Rules

• Confidence: 90% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

### OpenClaw Chat Execution Rules

- OpenClaw does NOT auto-source the skill .env file
- If `~/.openclaw/workspace/skills/nano-banana-pro-openrouter/.env` exists:
  1. Use the `read` tool to read `.env`
  2. Extract `OPENROUTER_API_KEY` and `OPENROUTER_BASE_URL`

• Confidence: 99% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

1. Use the `read` tool to read `.env`
  2. Extract `OPENROUTER_API_KEY` and `OPENROUTER_BASE_URL`
  3. Always pass the key via `--api-key` when running the script
- Only ask the user if .env is missing or the key cannot be read
- If the user asks for a timestamped filename, prefer `--filename auto` (do not handwrite dates)

If neither is available, the script exits with an error message.

• Confidence: 99% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

- `command -v base64` (must exist)

Common failures:
- `Error: No API key provided.` -> read .env and retry with --api-key; if still failing, ask the user to set OPENROUTER_API_KEY
- `Error: No API base URL provided.` -> ensure OPENROUTER_BASE_URL is set to a full chat completions endpoint
- `Error loading input image:` -> wrong path or unreadable file; verify --input-image points to a real image
- "quota/permission/403" style API errors -> wrong key, no access, or quota exceeded; try a different key/account

• Confidence: 96% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

script_dir=$(cd "$(dirname "$0")" && pwd)
skill_dir=$(cd "$script_dir/.." && pwd)

load_env_file "$PWD/.env"
load_env_file "$skill_dir/.env"

if [ -z "$api_key" ]; then

• Confidence: 91% confidence
• Finding: .env"

Credential Access

High

• Category: Privilege Escalation

Content

skill_dir=$(cd "$script_dir/.." && pwd)

load_env_file "$PWD/.env"
load_env_file "$skill_dir/.env"

if [ -z "$api_key" ]; then
  api_key=${OPENROUTER_API_KEY:-}

• Confidence: 83% confidence
• Finding: .env"

VirusTotal

57/57 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.