ClawHub
Back to skill

Security audit

nano banana pro pptx

Security checks across malware telemetry and agentic risk

Overview

This skill coherently generates local PowerPoint decks using Gemini, with expected API-key, network, dependency, and file-output behavior disclosed enough for normal use.

Before installing, treat your Gemini API key as sensitive, avoid confidential presentation prompts unless you trust the configured Gemini endpoint, avoid untrusted custom base URLs, and expect the tool to create a local output directory containing intermediate files plus the final PPTX.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill instructs use of a Python script that consumes environment secrets, performs network access to Gemini or a custom base URL, and writes a PPTX file, but the skill metadata does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: users and any permission system may not realize the skill can exfiltrate API keys to arbitrary endpoints or write files to unexpected locations.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.