Security audit

Work Productivity Nano Banana Workflow Helper

Security checks for vulnerabilities and agentic risk

Overview

The skill is not obviously malicious, but it uses very broad automatic activation rules that could steer unrelated tasks into this workflow.

Review the activation behavior before installing. This skill should be narrowed to explicit Nano Banana Pro workflow requests or invoked manually; otherwise ordinary requests about editing, images, bug fixes, or generic productivity work may load this skill unexpectedly.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (14)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger keywords and example invocations are extremely broad (for example, generic terms like "nano", "pro", "generate", "edit", and "bug fix"), which can cause the skill to activate on ordinary unrelated user requests. Over-broad activation increases the chance of unintended routing, prompt-context pollution, and accidental execution of this skill in situations where the user did not intend it, which is a real security and reliability issue for agent systems.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest description says to use the skill when a user asks for broad categories like "work-productivity" or needs a "practical workflow, artifact, checklist, analysis, or implementation support," which describes a huge range of normal tasks. This ambiguous activation language can make the orchestrator select the skill outside its intended niche, leading to misrouting and unnecessary exposure of the skill's instructions in unrelated contexts.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger list includes extremely generic terms like "nano," "banana," "pro," "generate," "edit," and "images," which can cause the skill to activate for many unrelated user requests. Over-broad activation increases the chance the wrong skill is invoked, creating prompt-routing confusion, unintended instruction injection surface, and responses that do not match user intent.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill description declares activation for broad categories like work-productivity and several generic tokens, without clear boundaries on when the skill should not be used. In a multi-skill environment, this can lead to overmatching and accidental invocation, which is dangerous because the agent may follow an unrelated workflow and mishandle user intent or data.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger keywords include extremely broad everyday terms such as "nano", "banana", and "pro", which can cause the skill to activate in many unrelated conversations. This increases the chance of unintended routing, causing the agent to apply the wrong workflow, produce irrelevant actions, or override more appropriate skills in contexts that were never meant to invoke this one.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Enabling implicit invocation without meaningful activation constraints allows the platform to auto-select this skill based on vague semantic matches rather than explicit user intent. In combination with the broad skill description, this raises the risk of unauthorized or inappropriate invocation, potentially exposing user prompts and agent context to a skill that was not deliberately chosen.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger sentence is extremely broad and can match ordinary user language unrelated to this skill’s intended scope, causing accidental activation. In an agent system, over-broad routing can inject irrelevant instructions or artifacts into unrelated tasks, reducing reliability and potentially steering workflows in unsafe or unintended directions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The usage section defines the skill with vague keywords and broad trigger descriptions such as 'practical workflow,' 'generate,' 'edit,' and 'bug fix,' which are common across many unrelated tasks. In an agentic environment, this ambiguity increases the chance of accidental routing to this skill, causing misexecution, user confusion, or unsafe application of instructions outside the intended Nano Banana workflow context.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger sentence is extremely broad and overlaps with ordinary user requests for help, practical workflows, or bug fixing. This can cause unintended skill invocation, leading the agent to activate this workflow in contexts where the user did not explicitly request it, which may override more appropriate skills or introduce unexpected behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: Although this is labeled as a Chinese README, key user-facing sections including the title, requirement description, usage guidance, and trigger phrases are largely in English. This can amount to an implicit language policy choice without user opt-in, especially in a locale-specific document that users would reasonably expect to be fully localized.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: 该技能文件为 SKILL.zh-CN.md，内容整体以中文呈现，但未见任何说明用户可选择其他语言，或该语言限制仅适用于特定地区/受众。按规则，若技能在自然语言层面强制特定语言且无用户选择或合理限定，属于语言/locale 策略风险。
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger examples only show positive matches and do not provide counterexamples or constraints to prevent accidental activation. Without negative examples, downstream routing logic and maintainers have less guidance on ambiguous cases, making false activations more likely and reducing reliability of skill selection.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The default prompt and description use very broad trigger language such as 'work-productivity,' 'practical workflow,' 'artifact,' 'checklist,' and 'analysis,' which can match many unrelated user requests. This increases the chance of accidental invocation, causing the agent to route tasks into this skill when the user did not intend to use it, which can lead to incorrect behavior, scope creep, or unintended exposure of context to the skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The activation examples are ambiguous, truncated, and lack precise constraints, making it unclear when the skill should or should not run. This increases the chance of false-positive activation across unrelated conversations, which is especially risky for a general work-productivity skill because its broad domain already overlaps many benign user requests.
Content: No source excerpt is available for this finding.