Security audit

Nano Banana

Security checks for vulnerabilities and agentic risk

Overview

This image-generation skill is mostly coherent, but it tells the agent to use an unbundled local CLI that would handle your Gemini API key, prompts, and reference images outside the reviewed package.

Review or independently trust the local nano-banana CLI before installing because it is not included in the reviewed package. Use a dedicated, restricted Gemini API key, keep the key file locked down, and avoid sending private, regulated, or proprietary images unless you are comfortable sharing them with Google and with the local helper script.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly instructs sending user prompts and reference images to Google's external API, but it does not require any user-facing notice or consent step about third-party data sharing. This is dangerous because users may provide sensitive images or confidential text without realizing that the data leaves the local environment and is processed by an external provider.

Natural-Language Policy Violations

Medium

Confidence: 85% confidence
Finding: The skill instructs the agent to translate any non-English user request into English without opt-in, which can alter meaning, tone, or sensitive nuance in user instructions. While not a classic exploit, this creates a privacy and integrity risk because user content is transformed before transmission to a third party, potentially against user expectations.

Static analysis

No suspicious patterns detected.