Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent SEO image-generation helper, but users should understand it relies on Gemini/nanobanana tooling, local helper commands, generated file storage, and cost logging.
Install only if you intend to use Gemini/nanobanana for SEO image generation and are comfortable with API usage costs, generated images being saved locally, and usage/preset state being kept under your home directory. Review the external banana extension and helper scripts before relying on the local fallback commands.
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
# Log a generation
cost_tracker.py log --model gemini-3.1-flash-image-preview --resolution 1K --prompt "coffee shop hero"
# View summary (total + last 7 days)
cost_tracker.py summary
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
cost_tracker.py today
# Estimate before batch
cost_tracker.py estimate --model gemini-3.1-flash-image-preview --resolution 1K --count 10
# Reset ledger
cost_tracker.py reset --confirm
The invocation description includes broad phrases like 'banner', 'thumbnail', and 'create visual', which can cause the skill to trigger in unrelated contexts. Overbroad activation increases the chance that the agent enters a workflow that may execute tools or commands without the user's specific intent to use this extension.
The skill instructs the agent to execute local shell and Python commands for preset discovery (presets.py list) in addition to the declared MCP image-generation workflow. Even though this appears operational rather than malicious, expanding behavior into local command execution increases attack surface and can expose the host to unsafe file access or execution if surrounding paths, arguments, or referenced content are compromised.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
After every successful generation, guide the user on:
keyword-description-widthxheight.webpSkill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.
| MCP not configured | Run `./extensions/banana/install.sh` |
| API key invalid | New key at https://aistudio.google.com/apikey |
| Rate limited (429) | Wait 60s, retry. Free tier: ~10 RPM / ~500 RPD |
| `IMAGE_SAFETY` | Rephrase prompt - see `references/prompt-engineering.md` Safety section |
| MCP unavailable | Fall back: `python3 ~/.Codex/skills/seo-image-gen/scripts/generate.py --prompt "..." --aspect-ratio "16:9"` |
| Extension not installed | Show install instructions: `./extensions/banana/install.sh` |
Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.
| MCP not configured | Run `./extensions/banana/install.sh` |
| API key invalid | New key at https://aistudio.google.com/apikey |
| Rate limited (429) | Wait 60s, retry. Free tier: ~10 RPM / ~500 RPD |
| `IMAGE_SAFETY` | Rephrase prompt - see `references/prompt-engineering.md` Safety section |
| MCP unavailable | Fall back: `python3 ~/.Codex/skills/seo-image-gen/scripts/generate.py --prompt "..." --aspect-ratio "16:9"` |
| Extension not installed | Show install instructions: `./extensions/banana/install.sh` |
Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.
| MCP not configured | Run `./extensions/banana/install.sh` |
| API key invalid | New key at https://aistudio.google.com/apikey |
| Rate limited (429) | Wait 60s, retry. Free tier: ~10 RPM / ~500 RPD |
| `IMAGE_SAFETY` | Rephrase prompt - see `references/prompt-engineering.md` Safety section |
| MCP unavailable | Fall back: `python3 ~/.Codex/skills/seo-image-gen/scripts/generate.py --prompt "..." --aspect-ratio "16:9"` |
| Extension not installed | Show install instructions: `./extensions/banana/install.sh` |
Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.
| MCP not configured | Run `./extensions/banana/install.sh` |
| API key invalid | New key at https://aistudio.google.com/apikey |
| Rate limited (429) | Wait 60s, retry. Free tier: ~10 RPM / ~500 RPD |
| `IMAGE_SAFETY` | Rephrase prompt - see `references/prompt-engineering.md` Safety section |
| MCP unavailable | Fall back: `python3 ~/.Codex/skills/seo-image-gen/scripts/generate.py --prompt "..." --aspect-ratio "16:9"` |
| Extension not installed | Show install instructions: `./extensions/banana/install.sh` |
The fallback path directs execution of a local Python generator when MCP is unavailable, which materially changes the trust model from remote-tool use to local code execution. In a skill file, fallback execution paths are dangerous because they can bypass expected controls, invoke unreviewed scripts, and create a command-execution avenue on the user's machine.
The instruction to load this reference "when the user asks about costs or before batch operations" is broad and underspecified. It does not define clear trigger phrases, scope boundaries, or exclusion conditions, so common requests about costs could activate it unintentionally.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
which ffmpeg # For video/animation
Install ImageMagick if not present: `sudo apt install imagemagick` (Debian/Ubuntu) or `brew install imagemagick` (macOS).
## Common Operations
This section explicitly teaches users how to rephrase prompts after safety blocks and frames blocked content as something to work around rather than respect. Even though some examples are mild or framed as benign substitutions, the overall guidance enables iterative bypass of model safety controls, which can be repurposed to obtain disallowed violent, celebrity, or otherwise restricted image outputs.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Users can create their own presets:
python3 ~/.claude/skills/seo-image-gen/scripts/presets.py create my-brand
The skill's stated purpose is generating SEO images, but it also instructs the agent to log usage and query summaries via local Python scripts. Cost reporting may be operationally useful, yet this is still an extra local-execution capability not disclosed in the manifest's purpose statement.
This markdown file documents behavior that writes generated images to ~/Documents/nanobanana_generated/, which affects user data on disk. The description states the save location but does not present it as a caution or user warning, despite the operation creating persistent files automatically.
The markdown includes looped ImageMagick commands that write derived files for every matching PNG in a user directory. While the commands are understandable, the document does not explicitly warn that running them will create or overwrite multiple files in bulk, which is a user-impacting filesystem operation.