Nano Banana Pro

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 6:52 AM UTC
• Version: 0.1.0

Overview

This skill is a straightforward Gemini image-generation helper, with normal API-key and image-file handling for its purpose but some privacy and dependency hygiene caveats.

Install only if you are comfortable sending your prompts and any selected images to Google's Gemini API. Prefer GEMINI_API_KEY or a protected secret mechanism over passing --api-key on the command line, keep the key restricted and revocable, and use a non-sensitive output path because the script writes the requested PNG there.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/generate_image.py:2

Finding

Unbounded Runtime Dependency Resolution

Content

View full analysis

=3.10" # dependencies = [ # "google-genai>=1.0.0", # "pillow>=10.0.0", # ] # /// ``` ### Technical Analysis The script uses PEP 723 dependency metadata with minimum-version constraints but no upper bounds, exact version pins, integrity hashes, or repository-controlled lockfile. When the documented `uv run` command resolves these dependencies, it may select future package releases that were not reviewed with this Skill. Third-party packages execute with the same privileges as the invoking user during installation or import. In particular, the imported Google client can access the Gemini API key supplied to the process, while Pillow processes local and remotely generated image data. This does not prove that the current releases are malicious. It creates a supply-chain trust gap in which the code executed by the Skill can change after the audited package itself remains unchanged. ### Attack Path 1. An attacker compromises a maintainer account, release pipeline, package repository, or future permitted release of `google-genai` or `pillow`. 2. The attacker publishes a version satisfying `>=1.0.0` or `>=10.0.0`. 3. A user invokes the documented `uv run` command in an environment without a previously enforced, reviewed lockfile. 4. `uv` resolves and installs the compromised release. 5. Malicious package code executes during installation or import with the privileges of the user running the Skill. 6. The package may read the Gemini credential, inspect image inputs, modify generated files, or access other resources available to that user. ### Impact Assessment Successful exploitation would provide code execution under the account invoking the Skill. The accessible scope could include: - T ...[truncated 395 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/generate_image.py:59

Finding

Gemini API Key Accepted Through Process Command-Line Arguments

Content

View full analysis

str | None: """Get API key from argument first, then environment.""" if provided_key: return provided_key return os.environ.get("GEMINI_API_KEY") ``` ### Technical Analysis The script permits a Gemini API key to be supplied through `--api-key` or `-k`. Command-line arguments are not an appropriate secret transport because they may be exposed through: - Shell history files. - Process inspection facilities, subject to operating-system access controls. - Process monitoring and diagnostic tools. - Job-runner metadata or command logging. - Support bundles and audit logs that record complete commands. The environment-variable path already supported by the script is preferable to a command-line option, although a dedicated secret manager or protected file descriptor would provide stronger handling. ### Attack Path 1. A user or automation system invokes the script with `--api-key SECRET`. 2. The complete command is retained in shell history, orchestration metadata, process telemetry, or another command-capture mechanism. 3. A local user or operator with access to that data retrieves the key. 4. The exposed key is reused to invoke Gemini APIs within the permissions and quotas assigned to the credential. For live process inspection, exploitation additionally depends on the attacker's local permissions and the operating system's process-visibility controls. ### Impact Assessment An attacker obtaining the key could consume the associated ...[truncated 380 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_image.py (reported line 26)May include surrounding context.

python

def get_api_key(provided_key: str | None) -> str | None:
    """Get API key from argument first, then environment."""
    if provided_key:
        return provided_key
    return os.environ.get("GEMINI_API_KEY")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill requires access to an API key via environment variables but does not declare any explicit tool scope or permissions boundary. This weakens reviewability and least-privilege controls, making it harder for users and platforms to understand that the skill depends on secret-bearing environment access before execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs users to provide prompts and local image files to a script that calls Google's Gemini image API, but it never clearly warns that this content will be transmitted to a third-party service. Users may unintentionally send sensitive text, personal images, or proprietary data off-host without informed consent, creating privacy and confidentiality risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.