ClawHub
Back to skill

Security audit

Nano Banana

Security checks for vulnerabilities and agentic risk

Overview

The skill is clearly for Gemini image generation, but it relies on an external home-directory CLI that is not included for review while giving it the user's Gemini API key.

Install only if you already trust and control the separate ~/bin/nano-banana CLI. Before use, verify where that binary points, who can write it, and what code it runs, because the reviewed package does not include the implementation and the CLI will receive your Gemini API key plus prompts and reference images.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T07 · Tool Hijacking and Spoofing

Error
Location
SKILL.md:48
Finding

Execution of an Unverified External CLI with Access to Exported Credentials

Content
View full analysis
/nano-banana.js`. ``` ```markdown ## How Your Agent Should Use This 1. **Read the request and pick a model.** "Pro" → `pro`. "Fast" / "Flash" → `flash`. Otherwise → `pro`. 2. **Write the prompt in English.** Gemini image models work best in English even when the chat is in another language. Translate any non-English description into a clear, descriptive English prompt. 3. **Run the CLI** via `exec`. Capture the output path. 4. **Deliver the image** by adding `MEDIA:` on its own line in the reply (or use your platform's attachment convention). 5. **Reply** with a short caption + which model was used. ``` ### Technical Analysis The Skill instructs the Agent to execute `~/bin/nano-banana`, but the executable and its stated Node.js source are not included in the audited project. Consequently, the behavior described in the API contract cannot be verified against an implementation. A path under a user's home directory is mutable and may also be a symbolic link. The instructions do not require the Agent to validate the executable's canonical path, ownership, permissions, symlink target, cryptographic digest, or signature before execution. An attacker who can create or replace that path could therefore cause a legitimate-looking Skill invocation to execute attacker-controlled code. The risk is amplified because the Gemini API key is first exported as `GEMINI_API_KEY`. The subsequently launched CLI inherits this environment variable. File mode `600` ap ...[truncated 2197 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

Auth

Store the Gemini API key at ~/.openclaw/credentials/google/gemini_api_key (chmod 600).

Load it before invoking the CLI:

bash

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

Auth

Store the Gemini API key at ~/.openclaw/credentials/google/gemini_api_key (chmod 600).

Load it before invoking the CLI:

bash

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md
## How Your Agent Should Use This

1. **Read the request and pick a model.** "Pro" → `pro`. "Fast" / "Flash" → `flash`. Otherwise → `pro`.
2. **Write the prompt in English.** Gemini image models work best in English even when the chat is in another language. Translate any non-English description into a clear, descriptive English prompt.
3. **Run the CLI** via `exec`. Capture the output path.
4. **Deliver the image** by adding `MEDIA:<path>` on its own line in the reply (or use your platform's attachment convention).
5. **Reply** with a short caption + which model was used.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill instructs the agent to always translate user prompts into English before sending them to the external model. This can alter user intent, remove nuance, and cause sensitive or policy-relevant phrasing to be transformed without user awareness, which is especially risky when prompts contain legal, medical, cultural, or safety-sensitive details. Because the transformed prompt is what leaves the system boundary, it creates an integrity and transparency issue.

Content

No source excerpt is available for this finding.