ClawHub
Back to skill

Security audit

Nanobanana Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Gemini image generation/editing wrapper, but users should understand that prompts/images go to Google and dependencies are not pinned.

Install only if you are comfortable sending prompts and any selected input images to Google Gemini, and avoid submitting secrets, private documents, or sensitive personal images. Prefer running it in a virtual environment and pinning or reviewing dependency versions before use. Be aware that the current script also enables Google Search during Gemini calls even though the skill documentation does not call that out.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unpinned Third-Party Dependencies

Content
View full analysis

Vulnerability Details

File Location: requirements.txt, lines 1–4
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

text
python-dotenv
httpx[socks]
google-genai
Pillow

The installation instruction appears in SKILL.md, line 16:

bash
python3 -m pip install -r ${CLAUDE_PLUGIN_ROOT}/skills/nanobanana-skill/requirements.txt

Technical Analysis

All dependencies are specified without exact versions or integrity hashes. Consequently, repeated installations can resolve to different package versions over time. A compromised, malicious, or unexpectedly incompatible future release could be installed without a source change or additional review.

Because Python packages may execute code during installation and are subsequently imported into the application, compromise of a resolved dependency can result in code execution under the account installing or running the skill. The unpinned httpx[socks] dependency is not directly imported by nanobanana.py, which increases the dependency surface unless it is required transitively by another package.

This finding does not establish that any listed package is currently malicious. It identifies insufficient controls against dependency drift and upstream supply-chain compromise.

Attack Path

  1. An attacker compromises an upstream dependency release, maintainer account, or relevant package distribution path.
  2. The attacker publishes a malicious version satisfying the unrestricted dependency specification.
  3. A user follows the documented installation command.
  4. pip resolves and installs the attacker-controlled version because no reviewed version or package hash is enforced.
  5. Malicious code executes during package installation, import, or normal library use with the privileges of the installing or running user.

Impact Assessment

Successful exploitation could provide arbitrary code e ...[truncated 533 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin every direct dependency to a reviewed exact version, using ==.

  2. Generate and enforce a lock file containing cryptographic hashes, such as a hash-locked requirements file produced through pip-tools.

  3. Install dependencies with hash enforcement:

    bash
    python3 -m pip install --require-hashes -r requirements.txt

  4. Review and pin transitive dependencies as well as direct dependencies.

  5. Remove httpx[socks] if dependency analysis confirms it is unnecessary. If SOCKS support is not required, avoid enabling the extra.

  6. Use a trusted package index or controlled internal mirror and restrict fallback to unapproved indexes.

  7. Periodically scan dependencies for known vulnerabilities and update pins only after compatibility and security review.

  8. Perform installation in an isolated virtual environment or container with least privilege, and avoid installing packages as an administrator or root user.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
Findings (13)

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · nanobanana.py (reported line 20)May include surrounding context.

python
if not api_key:
    raise ValueError(
        "Missing GEMINI_API_KEY environment variable. Please check your .env file."
    )

# Initialize Gemini client

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: nanobanana-skill
description: 'Generate or edit images using Google Gemini API via nanobanana. Triggers: "nanobanana", "generate image", "create image", "edit image", "AI drawing", "图片生成", "AI绘图", "图片编辑", "生成图片".'
allowed-tools: Read, Write, Glob, Grep, Task, Bash(cat:*), Bash(ls:*), Bash(tree:*), Bash(python3:*)
---

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger phrases include very generic terms like "generate image," "create image," and "edit image," which are likely to match ordinary user requests unintentionally. This can cause the skill to activate in contexts where the user did not explicitly intend to use an external image-generation workflow, increasing the chance of unintended data handling or execution of the skill's toolchain.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill instructs users to provide prompts and input images for processing through the Google Gemini API, but it does not clearly warn that this data is transmitted to an external third-party service. Users may unknowingly submit sensitive text or private images, creating a privacy and data-governance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

User prompts and any provided input images are transmitted to the Gemini API, but the script does not present an explicit user-facing disclosure at the time of use. In an image-editing context, uploaded files may contain sensitive personal or proprietary content, so silent third-party transmission creates a meaningful privacy risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill enables the Google Search tool during image generation calls even though its stated purpose is only image generation/editing. This expands the model's effective capabilities and can cause user prompts or derived queries to be sent to web search unnecessarily, increasing data exposure and making behavior less predictable.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency list uses an unpinned package version for python-dotenv, which makes builds non-reproducible and can silently introduce vulnerable or breaking releases over time. In a skill that may be deployed automatically, this increases supply-chain risk because the resolved version can change without review.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
python-dotenv
httpx[socks]
google-genai
Pillow

Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
86% confidence
Finding

python-dotenv has known advisories, and because no version is pinned, there is no way to verify whether an affected release will be installed. That uncertainty is itself a supply-chain security weakness, especially if the skill writes or loads .env files in environments with sensitive secrets.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: httpx has 2 known advisory(ies) (CVE-2021-41945 (Improper Input Validation in httpx); CVE-2021-41945 (Encode OSS httpx <=1.0.0.beta0 is affected by improper input validation in `http)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
88% confidence
Finding

httpx is referenced without a pinned version while known advisories exist for some releases. Since this skill uses a network-facing API client, installing an affected version could expose request handling flaws or input-validation issues in code paths reachable during normal operation.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

google-genai is specified without a version, so installations may pull different releases at different times. This weakens reproducibility and can expose the skill to newly introduced security issues or incompatible behavior without any code change.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text
python-dotenv
httpx[socks]
google-genai
Pillow

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
98% confidence
Finding

Pillow is unpinned despite being a complex image-processing library with a long history of security advisories. Because this skill explicitly generates or edits images, the package is likely exercised on untrusted image data, making dependency drift more dangerous than in a non-image-processing context.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text
python-dotenv
httpx[socks]
google-genai
Pillow

Unverifiable Dependency: Pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
97% confidence
Finding

Pillow has many known security advisories, including issues relevant to malformed image parsing and resource consumption, and the manifest does not pin a safe version. In an image generation/editing skill, this is more dangerous because image inputs and outputs are central to the skill's functionality, increasing the chance that vulnerable parsing or processing paths are exercised.

Content

No source excerpt is available for this finding.