Security audit

Work Productivity Nano Banana Workflow Helper

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only workflow helper with no executable or persistent behavior, though its trigger wording is too broad and may cause accidental invocation.

Installing this skill is reasonable if you want a lightweight workflow helper, but consider narrowing its trigger phrases or disabling implicit invocation so ordinary requests about images, editing, bug fixes, or the word pro do not route into this skill unexpectedly.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger phrases are extremely broad, including generic terms like 'nano', 'pro', 'generate', 'edit', 'images', and 'bug fix', which can cause the skill to activate for many ordinary requests unrelated to the intended workflow. In an agent ecosystem, this creates an invocation-hijack risk where this skill may preempt more appropriate skills, leading to unintended behavior, prompt-scope confusion, or unsafe execution paths if the skill is later expanded with stronger actions.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest description says to use the skill when a user asks for broad terms like work-productivity, nano, banana, or pro, or when they need a generic workflow, artifact, checklist, analysis, or implementation support. This ambiguous activation condition is overbroad and can cause the skill to be selected for many unrelated requests, creating misrouting risk and allowing the skill's instructions to interfere with tasks outside its intended domain.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger list includes extremely generic terms such as "nano," "banana," "pro," "generate," "edit," and "images," which are likely to match many unrelated user requests. This can cause the skill to activate outside its intended scope, leading to incorrect routing, unintended influence over conversations, and increased attack surface for prompt collisions with unrelated tasks.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The description says the skill should be used when users mention broad terms like work-productivity, nano, banana, or pro, or whenever they need practical workflow or implementation support for the requirement. This boundary is too unclear and expansive, making accidental invocation likely and allowing this skill to compete with more appropriate skills on a wide range of normal user requests.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger keyword list includes very broad generic terms such as "nano", "banana", "pro", "generate", "edit", and "images", which can cause the skill to activate for many unrelated requests. Over-broad activation increases the chance that the agent applies the wrong workflow, injects irrelevant instructions into unrelated tasks, or interferes with safer skill routing.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger sentence is overly broad and includes generic phrasing like 'Help me' and 'I need a practical workflow', which can cause the skill to activate for many unrelated requests. This increases the chance of inappropriate routing, prompt hijacking of normal user intent, or accidental invocation in contexts where the skill is not relevant.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger examples are broad and natural-language-like enough that ordinary user requests could unintentionally match and invoke the skill. Because this skill targets a wide work-productivity use case with generic keywords like 'nano', 'banana', 'pro', and 'practical workflow', accidental activation is more likely and can route users into an unintended workflow, causing confusion, incorrect task handling, or misuse of agent context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This file is labeled as a Chinese README, but substantial user-facing content, including the title, requirement description, workflow description, keywords, and trigger phrases, is presented in English. That effectively imposes a language choice on users of the zh-CN variant without opt-in or explanation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 76% confidence
Finding: 该技能文件为 SKILL.zh-CN.md，正文与触发说明整体面向中文环境，但文档中没有说明这是可选语言版本，也没有向用户提供语言切换或选择机制。按规则，若技能在自然语言层面强制特定语言而无用户 opt-in，可能构成语言/区域策略问题。
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The default_prompt is overly broad, truncated, and stuffed with generic trigger terms, which can cause unintended invocation in contexts unrelated to the user’s actual request. Because implicit invocation is enabled, this ambiguity increases the chance the agent is selected when it should not be, potentially leading to incorrect actions, irrelevant guidance, or unsafe workflow assistance being injected into conversations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The invocation description lacks precise boundaries and mixes broad keywords with open-ended task types like 'practical workflow, artifact, checklist, analysis, or implementation support.' Without stronger constraints, the skill may be selected for loosely related productivity or implementation requests, creating unsafe overreach and reducing the reliability of skill routing.
Content: No source excerpt is available for this finding.