nano banana image to image

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:13 AM UTC
• Version: 1.0.1

Overview

This image-editing skill is purpose-aligned, but it needs Review because it mishandles API tokens and persists image/job data in ways users are not clearly told about.

Install only if you are comfortable sending image URLs and prompts to AtlasCloud. Do not provide a long-lived or high-privilege API token unless the skill is changed to avoid persistent memory storage and command-line secrets. The packaged API key should be treated as compromised and removed or revoked, and runtime result files/logs may retain image URLs and job metadata.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: .env:1

Finding

Hard-Coded AtlasCloud API Credential

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: generate.js:97

Finding

API Token Exposed Through Process Arguments and Persistent Agent Memory

Content

View full analysis

{baseDir}/params.json ``` `generate.js` reads the secret from the process argument vector: ```javascript const apiKey = process.argv[2]; const paramsFile = process.argv[3]; ``` ### Technical Analysis Command-line arguments are generally not an appropriate channel for secrets. Depending on the operating system and execution environment, arguments may be exposed through process inspection, shell history, command audit logs, orchestration telemetry, crash diagnostics, or agent tool-call transcripts. The instruction to store the token in agent memory creates an additional retention boundary. A reusable credential may survive longer than the immediate operation and may become available to future sessions or operators with access to that memory. This is an insecure secret-retention practice rather than confirmed memory-rule poisoning because the stored value is a user credential, not an attacker-controlled behavioral instruction. ### Attack Path 1. A user supplies an AtlasCloud token as directed by the skill. 2. The agent stores that token in its memory under `atlascloud_token`. 3. The agent invokes `generate.js` with the token embedded in the command line. 4. A local user, monitoring agent, process-inspection mechanism, shell-history reader, or log operator captures the process arguments or retained memory. 5. The captured token is replayed against AtlasCloud. Successful exploitation depends on access to process m ...[truncated 524 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: generate.js:128

Finding

Image URLs and Job Metadata Persisted in Predictable Plaintext Files

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: generate.js:42

Finding

Sensitive Prompt, Image URL, and Provider Response Logging

Content

View full analysis

log(` [${i}] ${u.substring(0, 80)}${u.length > 80 ? "…" : ""}`)); log(`Prompt : ${payload.prompt.substring(0, 80)}${payload.prompt.length > 80 ? "…" : ""}`); ``` It also serializes and logs every complete polling response: ```javascript log(`Attempt ${i}/${maxAttempts} | status: ${status} | response: ${JSON.stringify(res.data)}`); ``` ### Technical Analysis Truncating image URLs and prompts to 80 characters does not reliably redact them. The logged prefix may include a complete hostname, object key, query parameter, identifying text, or most of a short prompt. Logging every complete provider response may disclose generated image URLs, job identifiers, provider metadata, errors, and other response fields. Console output is frequently retained by agent frameworks, CI systems, container platforms, shell transcripts, and centralized logging services. This expands sensitive-data exposure from the immediate process to all systems and personnel with log access. ### Attack Path 1. A user submits private image URLs or a sensitive prompt. 2. `generate.js` prints URL and prompt prefixes during job submission. 3. During polling, the script prints complete provider responses. 4. An agent framework, terminal recorder, CI service, container runtime, or log collector retains the output. 5. A person or service with log access extracts the disclosed content metadata or URLs. 6. If an exposed image URL remains valid, it may be used to retrieve the associated image. ### Impact Assessment Potentially exposed data includes prompt text, source-image locations, generated-image locations, prediction identifiers, provider metadata, and error details. I ...[truncated 344 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Known Vulnerable Dependency: axios==1.14.0 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The lockfile pins axios to 1.14.0, and the static analysis indicates multiple published advisories affecting that version, including SSRF-related proxy bypass and prototype-pollution-based request/response manipulation issues. In an agent skill, HTTP client libraries are high-risk because they often handle outbound requests, credentials, redirects, and proxy behavior; if the vulnerable code paths are reachable, exploitation could lead to credential leakage, request forgery, or traffic interception/manipulation.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The lockfile includes form-data 4.0.5, and the reported CRLF injection issue in multipart field names/filenames can enable malformed request construction or header injection when untrusted input is embedded into multipart uploads. In an agent skill that may upload files or relay user-supplied form fields to external services, this increases the risk of request smuggling-like effects, downstream parser confusion, or abuse of receiving services.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.14.0 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

This skill depends on axios through a broad version range, and the analysis indicates that a vulnerable axios version such as 1.14.0 may be resolved. Because this skill appears to make external network requests for image-generation workflows, flaws in the HTTP client can materially increase risk, including SSRF, credential leakage, or response tampering depending on how requests are constructed and where the skill runs.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly instructs the agent to store the user's AtlasCloud API token in memory for future reuse, creating unnecessary persistent handling of a secret. For a single-purpose image-editing workflow, long-term retention of an API credential increases exposure to unintended reuse, leakage to other skills or sessions, and abuse if memory is later accessed or mis-scoped.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill tells the agent to save the user's API token to memory 'so it is not needed again' without warning the user that their credential will be stored persistently. This undermines informed consent around secret retention and can lead users to disclose credentials they would not knowingly agree to have stored beyond the immediate operation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · generate.js (reported line 15)May include surrounding context.

js

const fs    = require("fs");
const path  = require("path");

const BASE_URL = "https://api.atlascloud.ai/api/v1";
const MODEL    = "google/nano-banana-2/edit";

function log(...args) { console.log(...args); }

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The polling loop logs the full API response on every attempt, which may expose sensitive data returned by the remote service into terminal history, CI logs, or centralized log collectors. In this context, the skill sends user prompts and image references to a third-party service, so verbose response logging increases the chance of leaking generated URLs, metadata, or error payloads beyond the intended user.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script writes prediction metadata, output URLs, timestamps, and original input image references to local files without user warning or consent. If used on shared systems, workstations with backups, or agent environments that persist working directories, these files can unintentionally retain sensitive image sources or internal URLs after execution.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The header comment describes the script only as editing/combining images via the AtlasCloud model. In addition to calling the remote image-generation API, the implementation writes last_result.json and last_url.txt to disk, which is a side effect not reflected in the documentation and materially expands what the script does.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)

Low

• Category: Supply Chain
• Confidence: 84% confidence

Finding

The lockfile includes follow-redirects 1.15.11, which the scanner flags for leaking custom authentication headers across cross-domain redirects. In a skill context, that matters because agent integrations commonly make authenticated HTTP calls; if a malicious or compromised endpoint can trigger redirects, sensitive headers could be exposed to another domain.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency is specified with a caret range (^1.6.0), which allows automatic installation of newer minor and patch releases. This weakens reproducibility and can silently introduce vulnerable or incompatible versions into the skill, especially important here because the same dependency is also flagged as having vulnerable releases.

Content

Scanner excerpt · package.json (reported line 18)May include surrounding context.

json

"license": "MIT",
  "keywords": ["atlascloud", "nanobanana", "image-to-image", "ai", "image-generation"],
  "dependencies": {
    "axios": "^1.6.0"
  }
}