Gemini Image Gen

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:24 AM UTC
• Version: 1.3.1

Overview

The skill mostly does image generation as advertised, but its heartbeat guidance can prompt public posting, avatar changes, and memory saving without clear user-controlled approval boundaries.

Review this before installing. Use it only with prompts and images you are willing to send to Google, avoid opening or publishing generated galleries from untrusted prompts until captions are escaped, and do not let heartbeat workflows post publicly, change avatars, or save memories unless each action is explicitly approved. Prefer a pinned or otherwise verified ClawHub installer/update path.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/gen.py:242

Finding

Stored HTML Injection in Generated Image Gallery

Content

View full analysis

None: thumbs = "\n".join( [ f'\n' f' \n' f' {it["prompt"]}\n' f'' for it in items ] ) html = f""" gemini-image-gen ({engine}) :root {{ color-scheme: dark; }} body {{ margin: 24px; font: 14px/1.4 ui-sans-serif, system-ui; background: #0b0f14; color: #e8edf2; }} h1 {{ font-size: 18px; margin: 0 0 4px; }} .meta {{ color: #7a8a99; margin-bottom: 16px; font-size: 13px; }} .grid {{ display: grid; grid-template-columns: repeat(auto-fill, minmax(280px, 1fr)); gap: 16px; }} figure {{ margin: 0; padding: 12px; border: 1px solid #1e2a36; border-radius: 14px; background: #0f1620; transition: border-color .2s; }} figure:hover {{ border-color: #3b82f6; }} img {{ width: 100%; height: auto; border-radius: 10px; display: block; }} figcaption {{ margin-top: 10px; color: #b7c2cc; font-size: 13px; line-height: 1.4; }} a {{ color: inherit; text-decoration: none; }} .footer {{ margin-top: 24px; color: #4a5568; font-size: 12px; }}

gemini-image-gen

Engine: {engine} · {len(items)} images · {dt.datetime.now().strftime("%Y-%m-%d %H:%M")}

{thumbs}

Generated with gemini-image-gen by @IISweetHeartII

""" (out_dir / "index.html").write_text(html, encoding="utf-8") ``` ### Technical Analysis The value of `it["prompt"]` originate ...[truncated 2025 chars]

Remediation

View remediation

None: safe_engine = html.escape(engine, quote=True) thumbs = "\n".join( f""" {html.escape(it["prompt"], quote=True)} """ for it in items ) ``` Additional hardening should include: 1. Escape all current and future dynamic HTML fields according to their output context. 2. Keep filename validation in place and avoid accepting arbitrary URLs for image sources. 3. Add a restrictive Content Security Policy, preferably disallowing scripts entirely: ```html ``` 4. Add regression tests using prompts containing HTML tags, quotes, event handlers, and encoded markup. 5. Verify that generated captions display attack strings literally rather than interpreting them as markup. ]]>

T08 · Insecure Dependencies

Warning

• Location: INSTALL.md:3

Finding

Unpinned npx Package Execution in Installation and Update Instructions

Content

View full analysis

Remediation

View remediation

install gemini-image-gen ``` 2. Publish the expected package name, version, registry, publisher identity, and package digest in the installation documentation. 3. Use npm lockfiles and integrity metadata wherever the installation workflow supports them. 4. Prefer a locally installed, locked dependency over downloading and executing a mutable package during every installation or update. 5. In CI or other sensitive environments, use an allowlisted registry mirror and verify package signatures or checksums before execution. 6. Do not recommend running the installer with `sudo` or from a privileged account. 7. Pin Skill updates to reviewed releases or immutable commit hashes rather than implicitly accepting the latest available content. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration

Findings (11)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/gen.py (reported line 99)May include surrounding context.

python

prompts.append(
            f"{random.choice(styles)} of {random.choice(subjects)}, {random.choice(moods)}"
        )
    return prompts


def load_image_as_base64(path: str) -> tuple:

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The heartbeat guide expands behavior beyond the stated image-generation scope by encouraging social posting, profile avatar changes, and saving outputs to memory. These are higher-risk side effects because they can trigger external actions, modify user-facing accounts, and retain data without an explicit user request or consent boundary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly suggests posting generated images to social platforms and updating the profile avatar, both of which are external-sharing or account-affecting actions. In an autonomous or semi-autonomous agent context, this is dangerous because it can cause unintended publication, reputational harm, or unauthorized account changes without informed user approval.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The installation instructions tell users to execute npx clawhub install gemini-image-gen without pinning a specific version of the package being fetched and run. Because npx resolves and executes remote package code at install time, a compromised, typosquatted, or unexpectedly updated package version could run arbitrary code on the user's machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The update command again uses npx clawhub update gemini-image-gen without version pinning, which can cause users to fetch and execute whatever package version is current at the time. If the upstream package or dependency chain is compromised, this creates a supply-chain execution path on systems where the skill is installed.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to run npx clawhub install gemini-image-gen without pinning a specific package version. npx resolves and executes code from the registry at install time, so a compromised upstream package, typosquatted dependency, or later malicious update could cause arbitrary code execution on the user's system. In this context, the risk is real because the README is an installation path and users are likely to copy-paste it directly.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill advertises capabilities that require environment access, local file read/write, and outbound network access, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates a transparency and policy-enforcement gap: a host agent may grant broader access than the user expects, increasing the chance of unintended file access, data exfiltration, or unsafe execution context when the skill runs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation says the skill uses the Google Gemini API but does not clearly warn users that their prompts and, for edit mode, image contents are transmitted to a third-party service. This omission can cause users to unknowingly send sensitive text or images off-device, which is especially risky in agent environments where prompts may contain private, proprietary, or regulated data.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The quickstart uses npx clawhub install gemini-image-gen without pinning a specific clawhub version. Because npx resolves and executes the latest package version at install time, a compromised or malicious upstream release could run arbitrary code on the user's machine during setup. In this skill context, that risk is meaningful because the install flow is prominently documented and the skill expects an API key to be configured, making setup a high-trust moment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The instruction to save good results to memory introduces persistence of generated content without explaining retention, scope, or user control. This can lead to unexpected storage of sensitive or personal images/prompts and create privacy issues, especially if memory is later reused in other contexts.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The manifest and module description focus on generating and editing images through the Google Gemini API, but do not mention reading local environment state. Accessing environment variables for credentials is a capability beyond the user-facing purpose and matches the rule's example of a context-inappropriate capability.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.