Security audit

Work Productivity Nano Banana Workflow Helper

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only workflow helper with overly broad activation wording but no executable code, persistence, credential use, or hidden data flow.

Before installing, consider narrowing or disabling implicit invocation because generic terms like generate, edit, pro, and bug fix could cause accidental activation. The skill otherwise appears low risk: it ships no executable code and does not request credentials, persistence, or privileged access.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest description says to use the skill when a user asks for broad terms like work-productivity, nano, banana, pro, or general needs such as a practical workflow, artifact, checklist, analysis, or implementation support. These conditions are so expansive that the skill could be selected for many unrelated requests, creating prompt-routing ambiguity and increasing the attack surface for incorrect tool or skill invocation.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger list includes very common terms such as "nano," "banana," "pro," "generate," and "edit," which can match many unrelated user requests and cause unintended skill activation. Over-broad activation increases the chance this skill will intercept prompts outside its intended scope, leading to misrouting, user confusion, and possible unsafe delegation if users did not intend to invoke this workflow.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger list includes very generic terms such as "nano", "banana", "pro", "generate", "edit", and "images", which are likely to appear in many unrelated user requests. This can cause unintended skill activation, leading the agent to apply the wrong workflow, override more appropriate skills, or expose users to irrelevant or unsafe guidance in contexts they did not request.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger sentence is phrased broadly enough that ordinary user requests could unintentionally invoke this skill outside its intended niche. That can cause incorrect routing, unexpected execution of the skill, and over-collection or disclosure of user context to the wrong workflow, especially in agent systems that auto-select skills from natural language.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are broad and generic enough to match ordinary user requests with weak scope boundaries, which can cause this skill to activate in contexts the user did not intend. In an agent ecosystem, overbroad activation can route unrelated tasks into a workflow with mismatched instructions or capabilities, increasing the chance of unsafe handling, confusion, or policy-bypassing delegation chains.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger keywords and example invocations are very broad, including generic terms like "nano", "pro", "generate", "edit", and "bug fix", which are likely to match many unrelated user requests. This can cause accidental skill activation, injecting this workflow into contexts the user did not intend and potentially interfering with safer or more appropriate skills.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The example trigger sentences are truncated, vague, and do not show a realistic user request that clearly distinguishes when this skill should be used. Poor invocation guidance makes accidental or inconsistent activation more likely, reinforcing the already broad routing behavior and reducing operator ability to validate intended scope.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The invocation description says to use the skill when users mention broad terms like work-productivity, nano, banana, or pro, or whenever they need general workflow/checklist/analysis support for the requirement. This ambiguity makes the skill eligible for a wide range of ordinary requests, increasing the chance of accidental routing and reducing control over when the skill should be trusted to shape the response.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The file is a Chinese-language skill document but embeds English skill names, audience descriptions, trigger phrases, and example invocations such as "Help me" and "I need" without stating whether the user may choose their preferred language. This creates a locale/language policy concern because activation and usage cues appear partially fixed to specific languages rather than explicitly user-selectable.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The default prompt is extremely broad and partially malformed, combining generic terms like 'help me' with a wide set of workflow-related concepts. This can cause the skill to be selected in contexts far beyond its intended scope, increasing the chance of unintended prompt injection exposure, irrelevant activation, or the model routing sensitive user tasks into an ill-scoped helper.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Enabling allow_implicit_invocation without a clear trigger boundary lets the platform invoke this skill automatically based on loosely related user language. Because the skill metadata includes broad productivity and workflow terms, implicit invocation increases the risk of accidental routing, unintended tool influence, and exposure to adversarial or irrelevant inputs in situations where the user did not explicitly request this skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This generic request pattern lacks clear boundaries, so the skill may match a wide range of unrelated prompts simply because they contain common assistance language. In an automated agent environment, broad matching increases the chance of unintended tool use, misrouting, and unreliable outputs that may affect downstream tasks or expose data to an unnecessary processing path.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 74% confidence
Finding: The file is presented as a Simplified Chinese README, but core instructional content is written in English, which can impose a language choice on users without opt-in. This is a natural-language policy concern because the localized document does not consistently honor the advertised locale.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.