T08 · Insecure Dependencies
Warning
- Location
SKILL.md:16- Finding
Unpinned Third-Party Dependencies Create a Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
Nanobanana Image
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a legitimate Gemini image-generation skill, with expected third-party API use and some configuration and dependency hygiene risks to understand before use.
Install only in a dedicated virtual environment, pin or review dependency versions if possible, and do not use prompts, images, URLs, or .env files containing confidential data unless you are comfortable sharing the submitted content with Google services.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/generate.py:29- Finding
Overbroad .env Loading Exposes Unrelated Secrets to the Runtime
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The script reads environment variables and local .env files to obtain credentials and proxy settings, but the finding indicates this capability is not declared in the skill permissions. In an agent-skill context, undeclared access to environment-sourced secrets is a real security issue because it expands the skill’s effective privileges beyond what users or the platform may expect.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python def load_dotenv(): """Load environment variables from .env file (script directory first, then parent directory). Does not overwrite existing environment variables.""" script_dir = os.path.dirname(os.path.abspath(__file__)) candidates = [ os.path.join(script_dir, ".env"),
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python def load_dotenv(): """Load environment variables from .env file (script directory first, then parent directory). Does not overwrite existing environment variables.""" script_dir = os.path.dirname(os.path.abspath(__file__)) candidates = [ os.path.join(script_dir, ".env"),
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """Load environment variables from .env file (script directory first, then parent directory). Does not overwrite existing environment variables.""" script_dir = os.path.dirname(os.path.abspath(__file__)) candidates = [ os.path.join(script_dir, ".env"), os.path.join(script_dir, "..", ".env"), ] for path in candidates:
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """Load environment variables from .env file (script directory first, then parent directory). Does not overwrite existing environment variables.""" script_dir = os.path.dirname(os.path.abspath(__file__)) candidates = [ os.path.join(script_dir, ".env"), os.path.join(script_dir, "..", ".env"), ] for path in candidates:
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """Load environment variables from .env file (script directory first, then parent directory). Does not overwrite existing environment variables.""" script_dir = os.path.dirname(os.path.abspath(__file__)) candidates = [ os.path.join(script_dir, ".env"), os.path.join(script_dir, "..", ".env"), ] for path in candidates:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill metadata and description do not warn users that prompts, reference images, YouTube URLs, and search queries may be transmitted to external Google Gemini and Google Search services. In this skill’s context, that omission is meaningful because the core functionality explicitly encourages uploading local images and supplying external URLs, creating a risk of accidental disclosure of sensitive data to third-party services.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script transmits user prompts, optional local images, and possibly video/search-derived content to the external Google Gemini API, but it does not present an explicit runtime warning or confirmation about that data leaving the local environment. In a skill context that may process sensitive images or prompts, this creates a meaningful privacy and data-handling risk through unintended disclosure to a third party.
- Content
Static analysis
No suspicious patterns detected.