Security audit

Nano Banana Image T8

Security checks for vulnerabilities and agentic risk

Overview

The skill largely matches its image-generation purpose, but its bundled script handles API keys in ways that could expose them to unintended URLs.

Install only if you are comfortable with this skill storing and reusing a Nano Banana API key on disk. Use a limited, revocable key, avoid shared machines, do not override the base URL, and rotate/delete the saved key if you stop using the skill. The publisher should validate the fixed API host, use an unauthenticated client for image downloads, and offer explicit key deletion or non-persistent mode before this should be treated as low risk.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/test_nano_banana_2.py:303
Finding: Caller-Controlled Base URL Can Exfiltrate the API Key
Content: View full analysis
dict[str, str]: return {"Authorization": f"Bearer {api_key}"} ``` The supplied base URL is subsequently used for authenticated requests: ```python resp = client.post(f"{base_url}/v1/images/generations", json=payload, timeout=300) ``` ### Technical Analysis The documentation states that the API base address must remain fixed at `https://ai.t8star.cn`, but the implementation exposes `--base-url` without validating its scheme, hostname, port, or origin. All requests made through the client carry the global `Authorization: Bearer ` header. Consequently, anyone who can influence the script invocation can replace the legitimate API endpoint with an attacker-controlled HTTPS server and receive the user's API key in the initial request. This violates the documented endpoint restriction and exceeds the minimum privileges needed for image generation. Redirect processing is also enabled globally, increasing the number of destinations the client may contact, although the direct arbitrary base URL is sufficient to exploit the issue. ### Attack Path 1. A user supplies a valid Nano Banana API key, or the script loads a previously saved key. 2. An attacker-controlled instruction causes the script to be invoked with: ```b ...[truncated 1075 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/test_nano_banana_2.py:88
Finding: API-Controlled Image URLs Are Fetched with the Bearer Credential
Content: View full analysis
bytes: if "b64_json" in item and isinstance(item["b64_json"], str): return base64.b64decode(item["b64_json"]) url_value = item.get("url") if isinstance(url_value, str) and url_value: resp = client.get(url_value, timeout=60) resp.raise_for_status() return resp.content raise RuntimeError("响应中未包含 b64_json 或 url") ``` The API explicitly requests URL-based responses: ```python payload: dict[str, Any] = { "model": model, "prompt": prompt, "n": 1, "response_format": "url", } ``` The same pattern is used for image editing: ```python form_data: dict[str, str] = { "model": edit_model, "prompt": prompt, "n": "1", "response_format": "url", } ``` The download client has the API key attached globally: ```python with httpx.Client(headers=_build_headers(api_key), follow_redirects=True) as client: ``` ### Technical Analysis The image URL is obtained from a remote API response and is therefore untrusted. `_extract_image_bytes` passes that absolute URL to the same `httpx.Client` used for authenticated API calls. Because the client has a default bearer authorization header, a URL pointing to another origin receives the API key on the direct request. No validation restricts the URL to HTTPS or to an approved image-delivery host. The method also follows redirects, and the downloaded response is accepted as image data without checking its content type or size. This creates two related security problems: - The bearer credential may be disclosed to any host named in the API response. - The remote API can induce outbound GET requests to arbitrary reachable destinations. ...[truncated 1458 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:24
Finding: Long-Lived Plaintext API-Key Storage and Command-Line Secret Exposure
Content: View full analysis
' \ ``` The script stores the key as plaintext: ```python def _load_saved_api_key() -> str: if not _KEY_FILE.exists(): return "" return _KEY_FILE.read_text(encoding="utf-8").strip() def _save_api_key(api_key: str) -> None: _KEY_FILE.parent.mkdir(parents=True, exist_ok=True) _KEY_FILE.write_text(api_key.strip(), encoding="utf-8") os.chmod(_KEY_FILE, 0o600) ``` Interactive credentials are saved automatically: ```python entered = getpass.getpass("请输入 API Key（输入过程不可见）: ").strip() if not entered: raise SystemExit( "缺少 API key，请通过 --api-key / 环境变量 NANO_BANANA_API_KEY / 交互输入提供" ) _save_api_key(entered) print(f"API Key 已保存到: {_KEY_FILE}") return entered ``` Command-line key input is enabled here: ```python parser.add_argument("--api-key", default=os.getenv("NANO_BANANA_API_KEY", "")) ``` ### Technical Analysis Image generation requires the key only while making the remote requ ...[truncated 2520 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill invokes shell scripts, reads environment variables, persists credentials to disk, and performs network calls, but it does not declare an explicit tool/permission scope. That weakens containment and reviewability, making it easier for a broadly capable skill to access sensitive resources without clear policy boundaries.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Broad triggers such as 'image generation test' and 'image edit test' can cause the skill to activate outside the intended Nano Banana workflow. Because this skill can accept, use, and persist API keys, accidental activation increases the chance of unintended credential collection or execution in unrelated conversations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly stores API keys in a persistent file and reuses them in future sessions, but the user-facing description does not prominently warn users before that storage occurs. This creates a consent and secret-handling risk, especially in shared or multi-user environments where persisted credentials may outlive the user's expectation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file contains user-facing messages in Chinese, and the interactive prompts and errors throughout the script are also Chinese-only. For a general-purpose test utility, this imposes a specific language on users without opt-in or documented justification, which matches the natural-language locale policy violation criteria.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script persistently stores the API key under the user's home directory and automatically reuses it later. For a test utility, long-term credential retention increases the chance of local disclosure through weak filesystem hygiene, backups, shared accounts, or accidental inclusion in other tooling, even though the file mode is restricted to 0600.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Beyond testing image generation and editing, the code maintains a saved default model in ~/.whaleclaw/credentials/nano_banana_default_model.txt and exposes commands to show or change it. This is a convenience configuration capability rather than a direct requirement of the declared testing purpose.
Content: No source excerpt is available for this finding.