Nano Banana

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 3:27 AM UTC
• Version: 1.0.0

Overview

This skill coherently generates or edits images through Google's Gemini image API, with some normal but important privacy, credential, and dependency hygiene cautions.

Install only if you are comfortable sending prompts and any selected input images to Google's Gemini service. Prefer setting GEMINI_API_KEY outside chat, do not paste long-lived API keys into the conversation or command line, avoid sensitive images unless you accept the provider's data handling, and consider running with locked dependency versions in a restricted environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/generate_image.py:2

Finding

Unpinned Runtime Dependencies Create a Supply-Chain Execution Risk

Content

View full analysis

=3.10" # dependencies = [ # "google-genai>=1.0.0", # "pillow>=10.0.0", # ] # /// ``` The documented invocation causes `uv` to resolve these dependencies: ```bash uv run ~/.codex/skills/nano-banana-pro/scripts/generate_image.py --prompt "your image description" --filename "output-name.png" [--resolution 1K|2K|4K] [--api-key KEY] ``` ### Technical Analysis The dependency declarations use unrestricted minimum-version constraints rather than exact, reviewed versions. The project contains no lockfile or package hashes. Consequently, `uv run` may download and execute a future dependency release that was not present during this audit. Python packages can execute code during installation, import, or normal API use. If a permitted future version of `google-genai` or `pillow`, or an artifact in its transitive dependency graph, is compromised, that code would execute with the privileges of the user running the Skill. The package names are consistent with the declared image-generation functionality, and no currently embedded malicious dependency was identified. The vulnerability is the absence of reproducible, integrity-verified dependency resolution. ### Attack Path 1. An attacker compromises a future release of an allowed package or one of its transitive dependencies. 2. The malicious release still satisfies `google-genai>=1.0.0` or `pillow>=10.0.0`. 3. A user invokes the documented `uv run` command in an environment without a previously locked dependency set. 4. `uv` resolves and installs the compromised release. 5. Malicious code executes during installation, import, or package use. 6. The dependency code can access resources available to the Skill process ...[truncated 592 chars]

Remediation

View remediation

", # "pillow==", # ] ``` The exact versions should be selected through testing and security review rather than inferred from this audit. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_image.py:48

Finding

Gemini API Key Can Be Exposed Through Command-Line Arguments and Chat History

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (5)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md

- Prompt "A serene Japanese garden" → `2025-11-23-14-23-05-japanese-garden.png`
- Prompt "sunset over mountains" → `2025-11-23-15-30-12-sunset-mountains.png`
- Prompt "create an image of a robot" → `2025-11-23-16-45-33-robot.png`
- Unclear context → `2025-11-23-17-12-48-x9k2.png`

## Image Editing

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_image.py (reported line 23)May include surrounding context.

python

def get_api_key(provided_key: str | None) -> str | None:
    """Get API key from argument first, then environment."""
    if provided_key:
        return provided_key
    return os.environ.get("GEMINI_API_KEY")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill invokes a Python script that can read environment variables for GEMINI_API_KEY, but the manifest does not declare any explicit tool scope or permissions. This weakens reviewability and least-privilege controls because consumers cannot easily tell that the skill depends on environment access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs users to send prompts and optional input images to Google's external API, but it does not clearly warn that user content will leave the local environment and be processed by a third party. This creates privacy and data-handling risk, especially if users provide sensitive images, text, or embedded metadata.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md

Examples:
- Prompt "A serene Japanese garden" → `2025-11-23-14-23-05-japanese-garden.png`
- Prompt "sunset over mountains" → `2025-11-23-15-30-12-sunset-mountains.png`
- Prompt "create an image of a robot" → `2025-11-23-16-45-33-robot.png`
- Unclear context → `2025-11-23-17-12-48-x9k2.png`

## Image Editing

Static analysis

No suspicious patterns detected.