nano banana text to image in Atlas AI

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:11 AM UTC
• Version: 1.0.1

Overview

The skill does what it claims, but it handles the user's AtlasCloud API token in ways that deserve review before installation.

Review this skill before installing. Use a short-lived or low-privilege AtlasCloud token, avoid letting the agent store it in persistent memory, rotate the token if it may have appeared in command logs, and do not include sensitive private content in image prompts sent to AtlasCloud.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:23
• Finding: AtlasCloud API Token Persisted in General Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 23-28 **Vulnerability Type**: Sensitive credential persistence in general agent memory **Risk Level**: Medium ### Vulnerable Code ```markdown ## Token Setup Before generating images, you need the user's AtlasCloud API token. - Check memory for `atlascloud_token`. - If not found, ask the user: *"Please provide your AtlasCloud API token to get started."* - Save the token to memory as `atlascloud_token` so it is not needed again. ``` ### Technical Analysis The skill explicitly instructs the agent to save a reusable AtlasCloud bearer token in general agent memory. Authentication credentials should not be placed in persistent conversational memory because that storage may have a broader lifetime and access scope than the individual image-generation operation. This is insecure credential handling rather than agent memory poisoning: the value written to memory is a secret, not an attacker-controlled instruction intended to alter future agent behavior. The best matching classification is therefore `T09: Insecure Skill Coding Practices`. The vulnerability becomes exploitable if another session, skill, user, extension, diagnostic export, or compromised agent component can read the same memory namespace. No evidence in the audited files proves that such access is currently available, but the instruction unnecessarily creates a persistent secret whose exposure depends on the security boundaries of the hosting agent. ### Attack Path 1. The user asks the skill to generate an image. 2. The skill requests the user's AtlasCloud API token. 3. Following `SKILL.md`, the agent writes the token to memory under `atlascloud_token`. 4. The token remains available after the immediate generation operation. 5. A later component or session with access to the same memory reads or discloses the stored value. 6. The exposed bearer token is replayed against the AtlasCloud API until it expires or is revoked. Thi ...[truncated 591 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the instruction to store `atlascloud_token` in general conversational or agent memory. - Keep the token only for the lifetime of the current image-generation operation. - Supply the credential through a dedicated secret manager, protected environment variable, operating-system credential store, or restricted file descriptor. - If persistent storage is essential, require explicit user consent and use encrypted, access-controlled secret storage isolated from ordinary memory and conversation history. - Apply least privilege and short expiration periods to AtlasCloud tokens. - Provide users with a documented token-revocation procedure. - Ensure logs, traces, memory exports, error reports, and generated state never contain the token. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:32
• Finding: AtlasCloud Bearer Token Exposed Through Process Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 32-38; `generate.js`, lines 109-110 **Vulnerability Type**: Sensitive credential passed through command-line arguments **Risk Level**: Medium ### Vulnerable Code `SKILL.md` directs the agent to place the token directly in the command: ```markdown **Step 1:** Write the params to `{baseDir}/params.json`. **Step 2:** Run the script: ```bash node {baseDir}/generate.js <TOKEN> {baseDir}/params.json ``` ``` `generate.js` retrieves that credential from the process argument vector: ```javascript async function main() { const apiKey = process.argv[2]; const paramsFile = process.argv[3]; ``` ### Technical Analysis Command-line arguments are generally not an appropriate channel for secrets. Depending on the operating system and execution environment, process arguments may be visible through process inspection utilities, process metadata, monitoring or observability agents, crash reports, audit systems, shell history, job-runner logs, or orchestration interfaces. The script uses the supplied value as an HTTP bearer credential: ```javascript headers: { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json", }, ``` The API request itself is sent to the fixed HTTPS endpoint `https://api.atlascloud.ai/api/v1`; no plaintext network transmission was identified. The issue is the local exposure of the token before it is transmitted. ### Attack Path 1. The user provides an AtlasCloud API token. 2. The agent follows the documented invocation and starts: `node generate.js <TOKEN> <PARAMS_JSON_FILE>`. 3. The token is stored in the child process's argument vector. 4. A local user, monitoring component, job runner, or telemetry system capable of reading process arguments captures the command line while the process is active or from retained execution records. 5. The observer extracts the bearer token. 6. The observer replays it against AtlasCloud APIs until the credentia ...[truncated 667 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not pass the AtlasCloud token as a command-line argument. - Prefer a dedicated secret manager or protected operating-system credential store. - For a minimal redesign, read the token from a narrowly scoped environment variable such as `ATLASCLOUD_API_TOKEN`, while ensuring the execution environment does not record environment values. - Where supported, pass the token through standard input or an inherited file descriptor so it is absent from the process argument vector. - Clear references to the secret as soon as practical and never include it in success messages, errors, debug output, telemetry, or shell commands. - Update the documented interface and script together, for example: ```bash ATLASCLOUD_API_TOKEN='...' node generate.js /protected/path/params.json ``` with the script reading `process.env.ATLASCLOUD_API_TOKEN`. - Use short-lived, least-privileged tokens and rotate any token that may already have appeared in process or automation logs. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill instructs the agent to collect and persist the user's AtlasCloud API token in memory without clear consent, retention limits, or masking guidance. Persisting secrets beyond the immediate task increases the risk of unintended disclosure to other skills, future prompts, logs, or memory inspection, making compromise of the external account more likely.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The manifest-style description says to use the skill for phrases like "generate image", "create image", "draw a scene", and even "any request to produce a visual from a text prompt," then adds "Always use this skill" when the user wants to produce an image from descriptive text. These activation conditions are broad and lack exclusion criteria, increasing the chance of unintended invocation for generic conversation about images rather than explicit use of this specific provider/model.

External Transmission

Medium

• Category: Data Exfiltration

Content

const fs    = require("fs");
const path  = require("path");

const BASE_URL = "https://api.atlascloud.ai/api/v1";
const MODEL    = "google/nano-banana-2/text-to-image";

function log(...args) { console.log(...args); }

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script sends `params.prompt` to `https://api.atlascloud.ai` as part of the request payload, which transmits user-provided content off-system. The code logs that a request is being submitted, but it does not clearly warn users in the usage text or documentation that their prompt data will be sent to a third-party service.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This code writes `last_result.json` and `last_url.txt` to disk, which is a safety-relevant file operation. Although it logs after saving, there is no prior disclosure in the script usage/help text or a confirmation before creating files next to the script.

Natural-Language Policy Violations

Low

• Confidence: 81% confidence
• Finding: The file includes headings, warnings, field examples, and error tables partly in Portuguese (for example, `Payload Correto`, `descrição detalhada da imagem`, `NÃO inclua`, and `Quando usar esta skill`) while other instructions are in English. Without stating that the skill is Portuguese-specific or letting the user choose language, this can create a language/locale mismatch for users expecting a consistent language.

Intent-Code Divergence

Low

• Confidence: 79% confidence
• Finding: The module header describes the script as generating images from text prompts, but does not mention that it also persists output metadata and URLs to local files. The inline comment at L148 documents that behavior accurately, so this is only a mild intent/documentation divergence at the module level rather than a stronger contradiction.

Static analysis

No suspicious patterns detected.