Nano Banana Pro

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 6:52 AM UTC
• Version: 0.1.0

Overview

This skill is a straightforward Gemini image-generation helper, with normal API-key and image-file handling for its purpose but some privacy and dependency hygiene caveats.

Install only if you are comfortable sending your prompts and any selected images to Google's Gemini API. Prefer GEMINI_API_KEY or a protected secret mechanism over passing --api-key on the command line, keep the key restricted and revocable, and use a non-sensitive output path because the script writes the requested PNG there.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/generate_image.py:2
• Finding: Unbounded Runtime Dependency Resolution<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generate_image.py:2-8` **Vulnerability Type**: Supply-chain exposure through loosely constrained runtime dependencies **Risk Level**: Medium ### Vulnerable Code ```python # /// script # requires-python = ">=3.10" # dependencies = [ # "google-genai>=1.0.0", # "pillow>=10.0.0", # ] # /// ``` ### Technical Analysis The script uses PEP 723 dependency metadata with minimum-version constraints but no upper bounds, exact version pins, integrity hashes, or repository-controlled lockfile. When the documented `uv run` command resolves these dependencies, it may select future package releases that were not reviewed with this Skill. Third-party packages execute with the same privileges as the invoking user during installation or import. In particular, the imported Google client can access the Gemini API key supplied to the process, while Pillow processes local and remotely generated image data. This does not prove that the current releases are malicious. It creates a supply-chain trust gap in which the code executed by the Skill can change after the audited package itself remains unchanged. ### Attack Path 1. An attacker compromises a maintainer account, release pipeline, package repository, or future permitted release of `google-genai` or `pillow`. 2. The attacker publishes a version satisfying `>=1.0.0` or `>=10.0.0`. 3. A user invokes the documented `uv run` command in an environment without a previously enforced, reviewed lockfile. 4. `uv` resolves and installs the compromised release. 5. Malicious package code executes during installation or import with the privileges of the user running the Skill. 6. The package may read the Gemini credential, inspect image inputs, modify generated files, or access other resources available to that user. ### Impact Assessment Successful exploitation would provide code execution under the account invoking the Skill. The accessible scope could include: - T ...[truncated 395 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every dependency to an exact, reviewed version instead of using open-ended minimum constraints. 2. Commit a `uv.lock` file or equivalent repository-controlled lockfile and require locked or frozen execution. 3. Enable artifact hash verification where supported so altered distributions are rejected. 4. Use a trusted package index and explicitly disable unapproved supplemental indexes to reduce dependency-confusion exposure. 5. Perform dependency updates through a reviewed process that includes vulnerability scanning and changelog inspection. 6. Run the Skill in a restricted environment with minimal filesystem and network access. 7. Keep the Gemini credential scoped, monitored, and readily revocable. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/generate_image.py:59
• Finding: Gemini API Key Accepted Through Process Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generate_image.py:59-67` **Vulnerability Type**: Sensitive credential exposure through command-line arguments **Risk Level**: Low ### Vulnerable Code ```python parser.add_argument( "--api-key", "-k", help="Gemini API key (overrides GEMINI_API_KEY env var)" ) args = parser.parse_args() # Get API key api_key = get_api_key(args.api_key) ``` The related credential-selection function is: ```python def get_api_key(provided_key: str | None) -> str | None: """Get API key from argument first, then environment.""" if provided_key: return provided_key return os.environ.get("GEMINI_API_KEY") ``` ### Technical Analysis The script permits a Gemini API key to be supplied through `--api-key` or `-k`. Command-line arguments are not an appropriate secret transport because they may be exposed through: - Shell history files. - Process inspection facilities, subject to operating-system access controls. - Process monitoring and diagnostic tools. - Job-runner metadata or command logging. - Support bundles and audit logs that record complete commands. The environment-variable path already supported by the script is preferable to a command-line option, although a dedicated secret manager or protected file descriptor would provide stronger handling. ### Attack Path 1. A user or automation system invokes the script with `--api-key SECRET`. 2. The complete command is retained in shell history, orchestration metadata, process telemetry, or another command-capture mechanism. 3. A local user or operator with access to that data retrieves the key. 4. The exposed key is reused to invoke Gemini APIs within the permissions and quotas assigned to the credential. For live process inspection, exploitation additionally depends on the attacker's local permissions and the operating system's process-visibility controls. ### Impact Assessment An attacker obtaining the key could consume the associated ...[truncated 380 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `--api-key` and `-k` command-line options. 2. Continue supporting `GEMINI_API_KEY`, but inject it through a protected runtime secret mechanism rather than an interactive shell command. 3. Prefer an operating-system credential store, container secret, CI secret provider, or dedicated secret manager for automated deployments. 4. If interactive secret entry is necessary, read it without echoing through `getpass` or from a protected file descriptor. 5. Ensure errors and diagnostic logs never print the credential. 6. Restrict the API key to the required APIs, projects, quotas, and deployment contexts. 7. Rotate any key previously passed on a command line if command history or process telemetry may have retained it. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Credential Access

High

• Category: Privilege Escalation

Content

def get_api_key(provided_key: str | None) -> str | None:
    """Get API key from argument first, then environment."""
    if provided_key:
        return provided_key
    return os.environ.get("GEMINI_API_KEY")

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill requires access to an API key via environment variables but does not declare any explicit tool scope or permissions boundary. This weakens reviewability and least-privilege controls, making it harder for users and platforms to understand that the skill depends on secret-bearing environment access before execution.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs users to provide prompts and local image files to a script that calls Google's Gemini image API, but it never clearly warns that this content will be transmitted to a third-party service. Users may unintentionally send sensitive text, personal images, or proprietary data off-host without informed consent, creating privacy and confidentiality risk.

Static analysis

No suspicious patterns detected.