Security audit

Work Productivity Nano Banana Workflow Helper

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only workflow helper with broad activation wording, but it does not request sensitive access, install code, run commands, persist itself, or move data.

Installers should be aware that the skill may be invoked more often than intended because of broad keywords and implicit invocation; it is otherwise a low-risk documentation helper with no code execution or sensitive-access behavior in the inspected artifact.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description defines activation using vague phrases like 'use when a user asks for work-productivity, nano-banana-pro, nano, banana, pro, or needs a practical workflow, artifact, checklist, analysis, or implementation support,' which are not meaningful boundaries. Because many of these terms are generic, the skill may be selected for unrelated conversations, increasing the chance of misrouting, unintended prompt injection surface expansion, and confusing or unsafe task handling.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger list is excessively broad and includes generic terms like 'nano', 'banana', 'pro', 'generate', 'edit', and 'images', which are likely to appear in ordinary user requests unrelated to this skill. This can cause accidental invocation or routing collisions, leading the agent to apply the wrong workflow, produce irrelevant outputs, or override a more appropriate skill in multi-skill environments.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger keywords include extremely generic terms such as "nano", "banana", "pro", "generate", "edit", and "images", which are likely to appear in many unrelated prompts. This can cause unintended skill activation and context hijacking, leading the agent to apply this workflow in situations outside its intended scope.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger sentence begins with a very broad everyday phrase ('Help me ...'), which can cause the skill to activate on many unrelated user requests. Overbroad activation increases the chance the agent invokes this skill outside its intended scope, leading to prompt-routing mistakes, user confusion, and possible interference with safer or more relevant skills.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The keyword list includes highly generic terms such as 'nano', 'banana', 'pro', 'generate', 'edit', and 'images', which are broad enough to match many unrelated requests. This increases the risk of over-triggering the skill in normal usage, causing unintended invocation and potentially exposing user prompts or steering the agent into an irrelevant workflow.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger sentence starts with very common phrasing like 'Help me' and 'I need', which makes accidental activation much more likely in unrelated conversations. In an agent ecosystem, broad triggers can cause the wrong skill to be invoked, leading to confused task routing, unintended disclosure of user context to this skill, or misuse of workflow guidance outside its intended scope.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrases are broad, generic, and overlap with common conversational requests such as asking for help or a practical workflow. This can cause unintended activation outside the intended scope, leading the agent to inject this skill into unrelated tasks and potentially override more appropriate workflows or expose users to unexpected behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The activation description says the skill should be used for broad terms like work-productivity, nano, banana, and pro, or for general requests involving practical workflows, artifacts, checklists, analysis, or implementation support. This scope is so broad that it can match many unrelated user intents, increasing the chance of accidental invocation and inappropriate task routing.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger section provides only permissive keywords and positive examples, but no exclusions or negative examples showing when the skill should not fire. Without disambiguation rules, generic terms in ordinary prompts can activate the skill unexpectedly, which can degrade safety controls and interfere with correct skill selection.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The default prompt and description are overly broad and underspecified, using generic triggers like 'work-productivity', 'practical workflow', 'artifact', and 'analysis' without clear boundaries on when this skill should activate. In combination with a workflow-helper role, this can cause the agent to invoke the skill in unrelated contexts, increasing the chance of unintended prompt injection exposure, incorrect task routing, or unsafe assistance beyond the intended job-to-be-done.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Enabling implicit invocation without tight contextual constraints allows the platform to auto-select this skill for loosely related requests. Because the skill's scope is already broad, this increases the risk of over-invocation, unintended handling of sensitive workflows, and misapplication of the skill in contexts where its instructions or artifacts may be unsafe, irrelevant, or easier to manipulate.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Although the sentence adds some context, it still uses generic framing ('I need a practical workflow for ...') without clear boundaries that distinguish this skill from many ordinary productivity requests. This makes unintended invocation likely, especially in agent environments where loose keyword/phrase matching can misroute tasks and expose users to irrelevant or lower-quality automation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This file is presented as a Chinese README, but substantial operational content such as the demand statement, workflow description, and trigger phrases is written in English. That can effectively force a language choice on users without documenting an opt-in or offering a clear language-selection path.
Content: No source excerpt is available for this finding.