Security audit

Work Productivity Nano Banana Workflow Helper

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only workflow helper with overly broad trigger wording, but no code, credential use, persistence, or data-exfiltration behavior was found.

Installers should be aware that this skill may be invoked more often than intended because of broad trigger keywords and implicit invocation. Consider narrowing triggers before publishing broadly, but the inspected artifact is advisory text only and does not request sensitive access.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest description says to use the skill when a user asks for broad categories like "work-productivity" or needs a generic "workflow, artifact, checklist, analysis, or implementation support," which describes a vast range of normal requests. This ambiguous guidance makes the skill eligible for accidental or excessive routing, undermining least-privilege skill selection and increasing exposure to irrelevant or adversarial contexts.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger keywords include extremely generic terms like "nano," "banana," "pro," "generate," "edit," and "bug fix," which can cause the skill to activate for many unrelated user requests. Overbroad activation increases the chance that this skill is invoked out of context, leading to prompt-routing errors, unintended instruction injection surface, and interference with more appropriate skills.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger list includes very generic words such as "nano", "banana", "pro", "generate", "edit", and "images", which are common in unrelated user requests. This can cause the skill to activate outside its intended scope, leading to prompt hijacking of routing, irrelevant workflow injection, or accidental use in contexts where its instructions are not appropriate.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger phrases are broad, generic help-style sentences that can match ordinary user requests without strong scope boundaries, causing the skill to activate outside its intended niche. In an agent ecosystem, overbroad auto-invocation can misroute tasks, override more appropriate skills, and increase exposure to prompt or workflow abuse through unintended contexts.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger keywords and example invocations are broad, generic, and overlap with common terms like "work-productivity," "generate," "edit," and "bug fix," which can cause the skill to activate in unrelated contexts. In an agent ecosystem, this increases the risk of unintended routing, confusing task execution, and accidental invocation of workflow logic where the user did not intend to use this skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The example trigger sentences largely restate the broad requirement text and do not provide meaningful boundaries for safe activation. Because the examples are permissive and vague, they reinforce imprecise routing behavior and make it harder for systems or maintainers to distinguish intended use from incidental keyword matches.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The description says to use the skill whenever a user mentions broad terms like work-productivity, nano, banana, or pro, or whenever they need a practical workflow, checklist, analysis, or implementation support for the requirement. This is overly expansive and makes activation ambiguous, increasing the chance the skill is invoked for many unrelated requests and influences agent behavior in unintended contexts.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The default prompt uses a very broad invocation phrase tied to common terms like work-productivity, nano, banana, pro, workflow, artifact, checklist, and analysis, while implicit invocation is enabled. This increases the chance the skill is triggered in unrelated conversations, which can cause unintended execution, prompt-context pollution, or accidental use of a skill the user did not intend to invoke.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation scope is ambiguous because the keyword list and trigger sentences mix highly specific terms with very generic terms such as 'pro', 'generate', 'edit', and 'bug fix'. In a skill-routing system, this ambiguity can lead to accidental invocation on unrelated productivity, coding, or image-editing requests, reducing routing integrity and increasing the chance of inappropriate instructions being surfaced.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger examples are broad and include generic phrases like asking for a 'practical workflow', which can match ordinary user requests far outside the intended Nano Banana workflow domain. This can cause unintended skill activation, routing unrelated tasks into this skill and potentially bypassing more appropriate or safer skills through overmatching.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The file is explicitly a Chinese-language README ('README.zh-CN.md'), but key user-facing descriptive content is presented in English rather than Chinese. This creates a language/locale inconsistency without any opt-in or explanation, which may violate an organizational language policy requiring locale-appropriate content or user choice.
Content: No source excerpt is available for this finding.