Nano Banana 2 Direct

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 7:28 AM UTC
• Version: 1.0.1

Overview

This skill does what it claims: it calls Google's Gemini image API to generate or edit images, with some privacy and operational risks users should understand.

Install only if you are comfortable sending image prompts and any input images to Google's Gemini API. Prefer setting GEMINI_API_KEY outside chat and command-line history, keep output filenames inside the current project or a dedicated image folder, avoid overwriting existing files, and be aware that dependencies are resolved from the package registry at install/run time.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18

Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content

View full analysis

=3.10" # dependencies = [ # "google-genai>=1.0.0", # "pillow>=10.0.0", # ] # /// ``` ### Technical Analysis The installation instruction does not specify any versions, while the inline Python dependency metadata only specifies minimum versions. The project also contains no reviewed lockfile or package hashes. Consequently, dependency resolution can select any future release satisfying these constraints. This does not prove that the current packages are malicious. However, it prevents reproducible installation and expands the trust boundary to include future package releases and the availability and integrity of the package registry at installation time. A compromised maintainer account, malicious future release, or registry compromise could introduce code that executes when imported or used by the script. ### Attack Path 1. An attacker compromises a dependency publisher account, package release process, or relevant package-registry infrastructure. 2. The attacker publishes a malicious version of `google-genai` or `pillow` that satisfies the unconstrained or minimum-version dependency declaration. 3. A user installs or runs the skill after that version becomes available. 4. `uv` resolves and installs the malicious release because no exact version, lockfile, or hash prevents selection. 5. Malicious package code executes with the privileges of the user running the skill, either during installation or when imported by `generate_image.py`. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the Agent user. This may expose the `GEMINI_API_K ...[truncated 304 chars]

Remediation

View remediation

", # "pillow==", # ] ``` 2. Generate and commit a lockfile that records all transitive dependencies. 3. Require package hashes during installation so altered artifacts are rejected. 4. Make the installation command consume the reviewed lockfile rather than resolving the newest available releases. 5. Use automated dependency scanning and update packages only through a reviewed change process. 6. Where supported, use a trusted internal package mirror and provenance or signature verification. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_image.py:52

Finding

Gemini API Key Can Be Exposed Through Command-Line Arguments

Content

View full analysis

`. 2. The complete command is retained in shell history, an Agent transcript, execution logs, or process-monitoring telemetry, or is exposed through process inspection while the process is running. 3. A local user, log reader, support operator, or other principal with access to one of those sources retrieves the credential. 4. The exposed key is used to call Gemini APIs under the victim's acco ...[truncated 460 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_image.py:75

Finding

Caller-Controlled Output Path Allows Arbitrary File Overwrite Within User Privileges

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (6)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

md

- Prompt "A serene Japanese garden" → `2025-11-23-14-23-05-japanese-garden.png`
- Prompt "sunset over mountains" → `2025-11-23-15-30-12-sunset-mountains.png`
- Prompt "create an image of a robot" → `2025-11-23-16-45-33-robot.png`
- Unclear context → `2025-11-23-17-12-48-x9k2.png`

## Image Editing

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_image.py (reported line 23)May include surrounding context.

python

def get_api_key(provided_key: str | None) -> str | None:
    """Get API key from argument first, then environment."""
    if provided_key:
        return provided_key
    return os.environ.get("GEMINI_API_KEY")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill invokes code and depends on environment access (GEMINI_API_KEY) but does not declare an explicit tool/permission scope. That weakens least-privilege controls and can cause the skill to run with broader access than reviewers or users expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The name/description are broad enough to match generic image creation or editing requests, which can cause the skill to be selected in situations where users did not intend an external API call. In this skill, overbroad routing matters because prompts and possibly local images may be transmitted to a third-party service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill does not clearly warn that user prompts and any --input-image content are sent to an external Google API. This creates a real data exfiltration/privacy risk, especially if users provide sensitive images, proprietary artwork, or confidential prompt content without informed consent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

md

Examples:
- Prompt "A serene Japanese garden" → `2025-11-23-14-23-05-japanese-garden.png`
- Prompt "sunset over mountains" → `2025-11-23-15-30-12-sunset-mountains.png`
- Prompt "create an image of a robot" → `2025-11-23-16-45-33-robot.png`
- Unclear context → `2025-11-23-17-12-48-x9k2.png`

## Image Editing