Nano Banana Pro Prompts Skill

• Outcome: Review
• Latest audit: Jul 22, 2026 · 1:47 AM UTC
• Version: 0.1.0

Overview

This prompt skill appears legitimate, but it automatically runs install/update downloads and fetches preview images without enough user control or integrity safeguards.

Review this before installing if you do not want skills to run networked postinstall scripts. Expect contact with HuggingFace during install, during stale-cache checks, and when preview images are shown. Avoid pasting confidential articles, scripts, client data, personal information, or unpublished sensitive material into the remix workflow unless you are comfortable processing it through your AI assistant environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill instructs the agent to perform network operations such as checking for updates and downloading dataset content, but the manifest does not declare corresponding permissions. This creates a capability mismatch that can lead to unexpected outbound access, weaker reviewability, and policy bypass in hosts that rely on declared permissions for enforcement.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The workflow goes beyond recommending prompts and directs the agent to fetch remote images, write them to /tmp, invoke messaging tools, and execute cleanup commands. Expanding a content-recommendation skill into file/network/tool execution increases attack surface and can be abused for unreviewed remote content retrieval or unintended tool use.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The package declares that it auto-downloads a library on install and wires installation to a setup script. For a skill whose stated purpose is prompt recommendation, automatic network activity during install expands the trust boundary and creates supply-chain risk, because consumers execute code before reviewing what is fetched or how it is used.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The postinstall hook causes code execution automatically when the package is installed, even though the package appears to be a prompt library rather than software that inherently needs build-time setup. This is dangerous because postinstall scripts are a common supply-chain abuse vector and can perform network access or local file operations without explicit user consent.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README explicitly encourages users to paste full articles, video scripts, and notes into the skill, but provides no disclosure about how that content may be handled, stored, or transmitted. In an agent-skill context, this creates a real privacy and data-governance risk because users may submit proprietary, client, or unpublished content under the assumption it stays local when the skill may fetch remote data or interact with external tooling.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The README explicitly encourages users to paste full articles, video scripts, or notes into the skill workflow without any warning about privacy, confidentiality, or downstream data handling. This can lead users to submit sensitive unpublished, proprietary, or personal content to an AI assistant and external prompt-processing pipeline, creating an avoidable data exposure risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill mandates silent update checks and possible downloads from HuggingFace on every run without notifying the user. Silent outbound network access can leak usage patterns, fetch changed remote content into the workflow, and undermine user expectations about when external communication occurs.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The instructions require downloading external images with curl, saving them locally, sending them via a messaging tool, and deleting them via shell commands, all without safety controls or user warning. This combines network retrieval, local file handling, and tool invocation in a way that can expose the agent to malicious remote content and create unintended side effects.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.