nano banana text to image in Atlas AI

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:11 AM UTC
• Version: 1.0.1

Overview

The skill does what it claims, but it handles the user's AtlasCloud API token in ways that deserve review before installation.

Review this skill before installing. Use a short-lived or low-privilege AtlasCloud token, avoid letting the agent store it in persistent memory, rotate the token if it may have appeared in command logs, and do not include sensitive private content in image prompts sent to AtlasCloud.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:23

Finding

AtlasCloud API Token Persisted in General Agent Memory

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:32

Finding

AtlasCloud Bearer Token Exposed Through Process Arguments

Content

View full analysis

{baseDir}/params.json ``` ``` `generate.js` retrieves that credential from the process argument vector: ```javascript async function main() { const apiKey = process.argv[2]; const paramsFile = process.argv[3]; ``` ### Technical Analysis Command-line arguments are generally not an appropriate channel for secrets. Depending on the operating system and execution environment, process arguments may be visible through process inspection utilities, process metadata, monitoring or observability agents, crash reports, audit systems, shell history, job-runner logs, or orchestration interfaces. The script uses the supplied value as an HTTP bearer credential: ```javascript headers: { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json", }, ``` The API request itself is sent to the fixed HTTPS endpoint `https://api.atlascloud.ai/api/v1`; no plaintext network transmission was identified. The issue is the local exposure of the token before it is transmitted. ### Attack Path 1. The user provides an AtlasCloud API token. 2. The agent follows the documented invocation and starts: `node generate.js `. 3. The token is stored in the child process's argument vector. 4. A local user, monitoring component, job runner, or telemetry system capable of reading process arguments captures the command line while the process is active or from retained execution records. 5. The observer extracts the bearer token. 6. The observer replays it against AtlasCloud APIs until the credentia ...[truncated 667 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs the agent to collect and persist the user's AtlasCloud API token in memory without clear consent, retention limits, or masking guidance. Persisting secrets beyond the immediate task increases the risk of unintended disclosure to other skills, future prompts, logs, or memory inspection, making compromise of the external account more likely.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest-style description says to use the skill for phrases like "generate image", "create image", "draw a scene", and even "any request to produce a visual from a text prompt," then adds "Always use this skill" when the user wants to produce an image from descriptive text. These activation conditions are broad and lack exclusion criteria, increasing the chance of unintended invocation for generic conversation about images rather than explicit use of this specific provider/model.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · generate.js (reported line 16)May include surrounding context.

js

const fs    = require("fs");
const path  = require("path");

const BASE_URL = "https://api.atlascloud.ai/api/v1";
const MODEL    = "google/nano-banana-2/text-to-image";

function log(...args) { console.log(...args); }

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script sends params.prompt to https://api.atlascloud.ai as part of the request payload, which transmits user-provided content off-system. The code logs that a request is being submitted, but it does not clearly warn users in the usage text or documentation that their prompt data will be sent to a third-party service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code writes last_result.json and last_url.txt to disk, which is a safety-relevant file operation. Although it logs after saving, there is no prior disclosure in the script usage/help text or a confirmation before creating files next to the script.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The file includes headings, warnings, field examples, and error tables partly in Portuguese (for example, Payload Correto, descrição detalhada da imagem, NÃO inclua, and Quando usar esta skill) while other instructions are in English. Without stating that the skill is Portuguese-specific or letting the user choose language, this can create a language/locale mismatch for users expecting a consistent language.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The module header describes the script as generating images from text prompts, but does not mention that it also persists output metadata and URLs to local files. The inline comment at L148 documents that behavior accurately, so this is only a mild intent/documentation divergence at the module level rather than a stronger contradiction.

Content

No source excerpt is available for this finding.