nano banana image to image

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:13 AM UTC
• Version: 1.0.1

Overview

This image-editing skill is purpose-aligned, but it needs Review because it mishandles API tokens and persists image/job data in ways users are not clearly told about.

Install only if you are comfortable sending image URLs and prompts to AtlasCloud. Do not provide a long-lived or high-privilege API token unless the skill is changed to avoid persistent memory storage and command-line secrets. The packaged API key should be treated as compromised and removed or revoked, and runtime result files/logs may retain image URLs and job metadata.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: .env:1
• Finding: Hard-Coded AtlasCloud API Credential<![CDATA[ ## Vulnerability Details **File Location**: `.env:1` **Vulnerability Type**: Hard-coded secret **Risk Level**: High ### Vulnerable Code ```dotenv ATLASCLOUD_API_KEY=apikey-8e638200e8554e6691207441b78bcd79 ``` ### Technical Analysis The project contains a plaintext AtlasCloud API key in its distributed `.env` file. A credential committed or packaged with source code must be considered compromised because every person, process, archive, build system, or repository mirror with access to the project can retrieve it. The key appears to use the same bearer-token authentication mechanism expected by `generate.js`. If it remains active, an unauthorized party can submit requests to the AtlasCloud API under the associated account. ### Attack Path 1. An attacker obtains a copy of the project directory, source archive, repository, build artifact, or backup. 2. The attacker opens `.env` and extracts the AtlasCloud API key. 3. The attacker supplies the key as a bearer token in requests to the AtlasCloud API. 4. Requests execute under the privileges, quota, and billing scope assigned to the exposed key. No local privilege escalation is required; read access to the project is sufficient. ### Impact Assessment An attacker may obtain the API privileges granted to the exposed AtlasCloud key. The likely scope includes unauthorized image-generation jobs, quota consumption, service abuse, and potential billing impact. The key does not, based on the reviewed evidence, directly grant operating-system privileges. Because the credential has already been exposed in plaintext, merely deleting it from the current file is insufficient; historical copies may continue to contain it. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Revoke the exposed key immediately and issue a replacement. 2. Remove `.env` from the distributed package and all version-control history where feasible. 3. Add `.env` and other secret-bearing files to `.gitignore` and package exclusion rules. 4. Distribute an `.env.example` containing only a placeholder such as: ```dotenv ATLASCLOUD_API_KEY=replace_with_your_key ``` 5. Inject the key at runtime through a protected environment variable, secret manager, or standard input. 6. Restrict the replacement key to the minimum API permissions and quota required. 7. Enable provider-side usage monitoring, spending limits, expiration, and rotation. 8. Review AtlasCloud usage records for unauthorized activity associated with the exposed key. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: generate.js:97
• Finding: API Token Exposed Through Process Arguments and Persistent Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:27-31, 40`; `generate.js:97-98` **Vulnerability Type**: Unsafe credential handling **Risk Level**: High ### Vulnerable Code `SKILL.md` instructs the agent to retain the token and pass it directly on the command line: ```markdown - Check memory for `atlascloud_token`. - If not found, ask the user: *"Please provide your AtlasCloud API token to get started."* - Save the token to memory as `atlascloud_token` so it is not needed again. ``` ```bash node {baseDir}/generate.js <TOKEN> {baseDir}/params.json ``` `generate.js` reads the secret from the process argument vector: ```javascript const apiKey = process.argv[2]; const paramsFile = process.argv[3]; ``` ### Technical Analysis Command-line arguments are generally not an appropriate channel for secrets. Depending on the operating system and execution environment, arguments may be exposed through process inspection, shell history, command audit logs, orchestration telemetry, crash diagnostics, or agent tool-call transcripts. The instruction to store the token in agent memory creates an additional retention boundary. A reusable credential may survive longer than the immediate operation and may become available to future sessions or operators with access to that memory. This is an insecure secret-retention practice rather than confirmed memory-rule poisoning because the stored value is a user credential, not an attacker-controlled behavioral instruction. ### Attack Path 1. A user supplies an AtlasCloud token as directed by the skill. 2. The agent stores that token in its memory under `atlascloud_token`. 3. The agent invokes `generate.js` with the token embedded in the command line. 4. A local user, monitoring agent, process-inspection mechanism, shell-history reader, or log operator captures the process arguments or retained memory. 5. The captured token is replayed against AtlasCloud. Successful exploitation depends on access to process m ...[truncated 524 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not store API credentials in persistent agent memory by default. 2. Request the token only when needed and clearly disclose any retention behavior. 3. Pass the token through a protected environment variable, standard input, or operating-system secret manager rather than `process.argv`. 4. For example, read a runtime-injected variable: ```javascript const apiKey = process.env.ATLASCLOUD_API_KEY; ``` 5. Ensure command runners and telemetry systems redact authorization values and secret environment variables. 6. Avoid printing commands that contain credentials. 7. Define a short token lifetime and support explicit deletion or rotation. 8. Use narrowly scoped keys with provider-side quota limits. 9. Update `SKILL.md` so it does not instruct the agent to persist the token and does not demonstrate command-line secret transmission. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: generate.js:128
• Finding: Image URLs and Job Metadata Persisted in Predictable Plaintext Files<![CDATA[ ## Vulnerability Details **File Location**: `generate.js:128-140`; `last_result.json:2-8`; `last_url.txt:1` **Vulnerability Type**: Insecure storage of sensitive metadata **Risk Level**: Medium ### Vulnerable Code The script writes the job identifier, generated image URL, source-image URLs, and timestamp to fixed paths beside the script: ```javascript // Save result files next to this script const resultPath = path.join(__dirname, "last_result.json"); const urlPath = path.join(__dirname, "last_url.txt"); fs.writeFileSync(resultPath, JSON.stringify({ prediction_id: predictionId, image_url: imageUrl, timestamp: new Date().toISOString(), images: params.images, }, null, 2)); fs.writeFileSync(urlPath, imageUrl + "\n"); ``` The distributed project already contains persisted runtime data in `last_result.json`: ```json { "prediction_id": "0d2799c527ab4b9fbf87eb25218dc3e5", "image_url": "https://atlas-media.oss-us-west-1.aliyuncs.com/images/1724989b-952e-4e5b-9761-4a4a16d5c041.png", "timestamp": "2026-04-04T22:38:34.825Z", "images": [ "https://atlas-img.oss-accelerate-overseas.aliyuncs.com/images/2de5930e-7d52-43e2-8e0b-d4b891e84c55.png", "https://atlas-img.oss-accelerate-overseas.aliyuncs.com/images/4635a6c8-0d91-4176-817e-8f22ea5f86b7.png" ] } ``` `last_url.txt` also contains the generated image URL in plaintext: ```text https://atlas-media.oss-us-west-1.aliyuncs.com/images/1724989b-952e-4e5b-9761-4a4a16d5c041.png ``` ### Technical Analysis The output files have predictable names and are written into the shared skill directory without an explicit restrictive file mode, per-run isolation, expiration, or cleanup. Source-image URLs can reveal private user content or act as bearer-like access links when object storage permits access based solely on possession of the URL. Fixed filenames also preserve stale results. If a later execution fails before overwriting the files, instructions that unconditionally r ...[truncated 1342 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `last_result.json` and `last_url.txt` from the distributed project and version-control history. 2. Store per-run results in a dedicated temporary directory rather than beside executable code. 3. Create files with restrictive permissions, such as mode `0600`, where supported: ```javascript fs.writeFileSync(urlPath, imageUrl + "\n", { mode: 0o600 }); ``` 4. Use unique, unguessable filenames for each run and bind the result to the current prediction ID. 5. Clear or invalidate previous output files before submitting a new request. 6. Do not retain source-image URLs unless required for the immediate operation. 7. Delete temporary files after the result is delivered or after a short, documented retention period. 8. Validate that the result read by the agent matches the current job ID. 9. Prefer provider URLs with short expiration periods and access controls. 10. Add runtime artifacts to `.gitignore` and package exclusion rules. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: generate.js:42
• Finding: Sensitive Prompt, Image URL, and Provider Response Logging<![CDATA[ ## Vulnerability Details **File Location**: `generate.js:42-44, 73` **Vulnerability Type**: Excessive logging of sensitive data **Risk Level**: Medium ### Vulnerable Code The script logs source-image URLs and the prompt: ```javascript log(`Images : ${payload.images.length} URL(s)`); payload.images.forEach((u, i) => log(` [${i}] ${u.substring(0, 80)}${u.length > 80 ? "…" : ""}`)); log(`Prompt : ${payload.prompt.substring(0, 80)}${payload.prompt.length > 80 ? "…" : ""}`); ``` It also serializes and logs every complete polling response: ```javascript log(`Attempt ${i}/${maxAttempts} | status: ${status} | response: ${JSON.stringify(res.data)}`); ``` ### Technical Analysis Truncating image URLs and prompts to 80 characters does not reliably redact them. The logged prefix may include a complete hostname, object key, query parameter, identifying text, or most of a short prompt. Logging every complete provider response may disclose generated image URLs, job identifiers, provider metadata, errors, and other response fields. Console output is frequently retained by agent frameworks, CI systems, container platforms, shell transcripts, and centralized logging services. This expands sensitive-data exposure from the immediate process to all systems and personnel with log access. ### Attack Path 1. A user submits private image URLs or a sensitive prompt. 2. `generate.js` prints URL and prompt prefixes during job submission. 3. During polling, the script prints complete provider responses. 4. An agent framework, terminal recorder, CI service, container runtime, or log collector retains the output. 5. A person or service with log access extracts the disclosed content metadata or URLs. 6. If an exposed image URL remains valid, it may be used to retrieve the associated image. ### Impact Assessment Potentially exposed data includes prompt text, source-image locations, generated-image locations, prediction identifiers, provider metadata, and error details. I ...[truncated 344 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove prompts and image URLs from normal operational logs. 2. Replace complete provider responses with minimal status information: ```javascript log(`Attempt ${i}/${maxAttempts} | status: ${status}`); ``` 3. If correlation is necessary, log only a non-sensitive, truncated hash or separately generated request identifier. 4. Place verbose response logging behind an explicit debug flag that is disabled by default. 5. Apply structured redaction to URLs, query strings, authorization data, prompts, object keys, and provider response fields. 6. Configure short log retention and least-privilege access to logs. 7. Document which metadata is collected and obtain user consent where required. 8. Add automated tests that ensure tokens, prompts, image URLs, and complete API responses are not emitted in production mode. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Known Vulnerable Dependency: axios==1.14.0 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 94% confidence
• Finding: The lockfile pins axios to 1.14.0, and the static analysis indicates multiple published advisories affecting that version, including SSRF-related proxy bypass and prototype-pollution-based request/response manipulation issues. In an agent skill, HTTP client libraries are high-risk because they often handle outbound requests, credentials, redirects, and proxy behavior; if the vulnerable code paths are reachable, exploitation could lead to credential leakage, request forgery, or traffic interception/manipulation.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: The lockfile includes form-data 4.0.5, and the reported CRLF injection issue in multipart field names/filenames can enable malformed request construction or header injection when untrusted input is embedded into multipart uploads. In an agent skill that may upload files or relay user-supplied form fields to external services, this increases the risk of request smuggling-like effects, downstream parser confusion, or abuse of receiving services.

Known Vulnerable Dependency: axios==1.14.0 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: This skill depends on `axios` through a broad version range, and the analysis indicates that a vulnerable `axios` version such as 1.14.0 may be resolved. Because this skill appears to make external network requests for image-generation workflows, flaws in the HTTP client can materially increase risk, including SSRF, credential leakage, or response tampering depending on how requests are constructed and where the skill runs.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly instructs the agent to store the user's AtlasCloud API token in memory for future reuse, creating unnecessary persistent handling of a secret. For a single-purpose image-editing workflow, long-term retention of an API credential increases exposure to unintended reuse, leakage to other skills or sessions, and abuse if memory is later accessed or mis-scoped.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill tells the agent to save the user's API token to memory 'so it is not needed again' without warning the user that their credential will be stored persistently. This undermines informed consent around secret retention and can lead users to disclose credentials they would not knowingly agree to have stored beyond the immediate operation.

External Transmission

Medium

• Category: Data Exfiltration

Content

const fs    = require("fs");
const path  = require("path");

const BASE_URL = "https://api.atlascloud.ai/api/v1";
const MODEL    = "google/nano-banana-2/edit";

function log(...args) { console.log(...args); }

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The polling loop logs the full API response on every attempt, which may expose sensitive data returned by the remote service into terminal history, CI logs, or centralized log collectors. In this context, the skill sends user prompts and image references to a third-party service, so verbose response logging increases the chance of leaking generated URLs, metadata, or error payloads beyond the intended user.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script writes prediction metadata, output URLs, timestamps, and original input image references to local files without user warning or consent. If used on shared systems, workstations with backups, or agent environments that persist working directories, these files can unintentionally retain sensitive image sources or internal URLs after execution.

Intent-Code Divergence

Low

• Confidence: 77% confidence
• Finding: The header comment describes the script only as editing/combining images via the AtlasCloud model. In addition to calling the remote image-generation API, the implementation writes `last_result.json` and `last_url.txt` to disk, which is a side effect not reflected in the documentation and materially expands what the script does.

Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)

Low

• Category: Supply Chain
• Confidence: 84% confidence
• Finding: The lockfile includes follow-redirects 1.15.11, which the scanner flags for leaking custom authentication headers across cross-domain redirects. In a skill context, that matters because agent integrations commonly make authenticated HTTP calls; if a malicious or compromised endpoint can trigger redirects, sensitive headers could be exposed to another domain.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"license": "MIT",
  "keywords": ["atlascloud", "nanobanana", "image-to-image", "ai", "image-generation"],
  "dependencies": {
    "axios": "^1.6.0"
  }
}

• Confidence: 94% confidence
• Finding: The dependency is specified with a caret range (`^1.6.0`), which allows automatic installation of newer minor and patch releases. This weakens reproducibility and can silently introduce vulnerable or incompatible versions into the skill, especially important here because the same dependency is also flagged as having vulnerable releases.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: .env:1