NanoBanana PPT Skills

• Outcome: Review
• Latest audit: Jul 10, 2026 · 2:51 AM UTC
• Version: 0.1.0

Overview

The skill’s PPT and video generation behavior mostly matches its purpose, but its setup and documentation create avoidable risks around API keys and third-party processing of user documents.

Install only if you are comfortable sending source documents, generated slide images, and prompts to third-party AI providers. Do not paste real API keys into chat; configure them locally in a protected .env file or secret manager, use limited-scope keys, and rotate any key already shared in a prompt. Avoid confidential, regulated, or customer-sensitive material unless those providers are approved for that data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (36)

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The document includes a live-looking API key string in plaintext, even though it is labeled as an incorrect example. Secrets embedded in documentation are often copied, indexed, or harvested by scanners, and readers may mistakenly reuse or expose them further. In this context, the surrounding guidance is security-focused, which makes the embedded secret especially inconsistent and risky rather than harmless.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The documentation overstates safety by calling shell-based system environment variables the 'most secure' and 'completely safe' option, while recommending long-lived secrets in startup files and displaying them with `echo`. Shell rc files are plaintext, broadly readable by local processes under the same account, often copied into backups, and can leak through terminal history, logs, screenshots, or support sessions. In a setup guide, this misleading assurance can cause users to adopt weaker secret-handling practices without understanding the tradeoffs.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The document tells users GitHub submission is 'absolutely safe' and that tracked contents are 'all safe', but elsewhere encourages storing and backing up secret-bearing shell configuration content. That messaging can create false confidence and may lead users to mishandle backups or dotfiles containing API keys, increasing the chance of accidental disclosure outside the repository itself. The danger here is primarily misleading security guidance rather than an active exploit.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The workflow explicitly tells the agent to accept a user-supplied file path and read its contents, but it does not constrain accessible directories, require confirmation, or warn about local file access. In an agent environment, this can enable unintended disclosure of sensitive local files if a user or prompt causes the workflow to read arbitrary paths.

Missing User Warnings

Low

• Confidence: 79% confidence
• Finding: The workflow directs the agent to save generated images to local files with predictable names, but it does not clearly warn the user that local file creation will occur or where files will be written. This is a weaker issue than arbitrary file read, but it can still cause unexpected filesystem side effects, overwrites, or clutter in environments where file writes matter.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation tells users to print the API key directly with commands like `cat .env | grep GEMINI_API_KEY`, which exposes the full secret on screen and may leak into terminal history, screen recordings, logs, or shared sessions. While this is not remote code execution, it materially increases the chance of accidental credential disclosure.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The architecture explicitly routes user document content through external AI services and references credential-based integrations, but the document does not mention any privacy notice, consent flow, or warning that user data may be transmitted to third parties. In a content-generation skill, this omission can lead users or integrators to unknowingly expose sensitive documents to external providers, creating privacy, compliance, and data-handling risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The quickstart tells users to configure a third-party AI API and use it to generate slides from local documents, but it does not disclose that document contents may be sent to Google's service for processing. This can cause accidental exposure of sensitive or proprietary data because users are encouraged to upload markdown documents without any privacy, retention, or data-handling warning.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The README explicitly tells users to paste real API keys into a prompt sent to Claude Code, which unnecessarily exposes credentials to an AI session and any associated logging, transcript retention, or downstream tooling. In a skill context, this is more dangerous because the whole workflow is designed around an agent executing installation steps, so users may follow the prompt verbatim and disclose live secrets.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill-install workflow repeats the unsafe pattern of asking users to provide real API keys directly to Claude Code during installation. This creates avoidable credential exposure risk and is especially concerning for a skill because it normalizes giving secrets to an agent that may store, echo, or mishandle them while performing filesystem actions.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The invocation examples include broad natural-language phrases that closely resemble ordinary user requests, increasing the chance the skill is triggered unintentionally. That can cause user documents to be read and then sent to external image/video generation services without a clear, deliberate opt-in at activation time.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill description presents the functionality but does not explicitly warn that user-provided document content and generated slide images may be transmitted to third-party AI services such as Google Gemini and Kling AI. This creates a privacy and data-handling risk because users may supply sensitive business documents without informed consent.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script sends slide content and style text to Google's Gemini API for image generation, but it does not provide any explicit warning, consent gate, or data-classification check before transmitting that content off-host. If a slide plan contains proprietary, regulated, or personal data, users may unknowingly disclose it to a third-party service and create compliance or confidentiality issues.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The installer creates a plaintext .env file intended to hold API keys but does not clearly warn that secrets will be stored on disk in the skill directory. On multi-user systems, backups, sync tools, or accidental commits can expose those credentials, so this is a legitimate secret-handling weakness even though it is common practice.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The module base64-encodes local slide images and sends them to Anthropic's external API for analysis, but the code provides no user-facing consent, warning, or policy gate before transmitting potentially sensitive presentation content. In a slide-processing skill, this is a real privacy/data-exposure issue because users may reasonably assume files are processed locally unless clearly told otherwise.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The installation template instructs users to send their API keys to Claude Code as part of the setup conversation. That is a real secret-handling flaw because it encourages disclosure of sensitive credentials to an intermediary system rather than keeping them confined to local configuration.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The skill-install prompt again asks for real API keys inside the installation conversation, creating a clear path for accidental credential leakage. Because this is framed as the easiest installation path, users are likely to comply, making the practical risk higher than a purely theoretical documentation issue.

Credential Access

High

• Category: Privilege Escalation

Content

4. 配置 API 密钥 - 创建 .env 文件：
   cp .env.example .env

5. 编辑 .env 文件，填入我的 API 密钥：

   GEMINI_API_KEY=YOUR_GEMINI_API_KEY
   KLING_ACCESS_KEY=YOUR_KLING_ACCESS_KEY

• Confidence: 95% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

pip install google-genai pillow python-dotenv

4. 配置 API 密钥：
   cp .env.example .env

   然后编辑 .env 文件，填入我的 API 密钥：
   GEMINI_API_KEY=YOUR_GEMINI_API_KEY

• Confidence: 95% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

4. 配置 API 密钥：
   cp .env.example .env

   然后编辑 .env 文件，填入我的 API 密钥：
   GEMINI_API_KEY=YOUR_GEMINI_API_KEY
   KLING_ACCESS_KEY=YOUR_KLING_ACCESS_KEY
   KLING_SECRET_KEY=YOUR_KLING_SECRET_KEY

• Confidence: 95% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

### 2. API密钥配置 ✓
- GEMINI_API_KEY 已设置
- 密钥存储在 .env 文件中
- .gitignore 已配置，防止密钥泄露

### 3. 便捷脚本创建 ✓

• Confidence: 86% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

2. **.env** - 环境变量文件

**重要提醒**：
- ⚠️ 不要将 .env 文件提交到公共代码仓库
- ⚠️ API密钥已包含在 .gitignore 中
- ⚠️ 如需分享项目，删除 .env 文件中的密钥

• Confidence: 83% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

# 检查是否有 .env.example
    if [ -f "$SKILL_DIR/.env.example" ]; then
        print_info "创建 .env 文件..."
        cp "$SKILL_DIR/.env.example" "$SKILL_DIR/.env"
        print_success ".env 文件已创建"
        echo ""

• Confidence: 87% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

# 检查是否有 .env.example
    if [ -f "$SKILL_DIR/.env.example" ]; then
        print_info "创建 .env 文件..."
        cp "$SKILL_DIR/.env.example" "$SKILL_DIR/.env"
        print_success ".env 文件已创建"
        echo ""
        print_warning "请编辑 .env 文件，填入你的 API 密钥："

• Confidence: 87% confidence
• Finding: .env"

Credential Access

High

• Category: Privilege Escalation

Content

if [ -f "$SKILL_DIR/.env.example" ]; then
        print_info "创建 .env 文件..."
        cp "$SKILL_DIR/.env.example" "$SKILL_DIR/.env"
        print_success ".env 文件已创建"
        echo ""
        print_warning "请编辑 .env 文件，填入你的 API 密钥："
        print_info "  nano $SKILL_DIR/.env"

• Confidence: 85% confidence
• Finding: .env

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: API_MANAGEMENT.md:64