Security audit

Work Productivity Nano Banana Workflow Helper

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only workflow helper with no executable code, but its activation wording is overly broad and may cause accidental invocation.

This skill appears safe to install as a low-risk workflow helper, but users should invoke it explicitly by name until the publisher narrows its triggers and disables or tightens implicit invocation. Expect possible irrelevant activation for generic image-editing or productivity requests.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger keywords and example invocations are broad, generic, and partially unrelated to a narrowly scoped skill, increasing the chance that the agent invokes this skill in response to ambiguous requests. In an agent ecosystem, over-broad routing can cause unintended activation, irrelevant workflow execution, and unsafe cross-context behavior because the skill may act on requests the user did not intend for it.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest says to use the skill when a user asks for broad categories like "work-productivity" or needs nearly any "workflow, artifact, checklist, analysis, or implementation support," which is far too expansive. Ambiguous activation guidance increases the chance that orchestration systems or maintainers will invoke this skill for unrelated requests, weakening skill isolation and predictability.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger list includes extremely generic terms like "nano," "banana," "pro," "generate," "edit," and "bug fix," which can match many unrelated user requests. This can cause the skill to activate outside its intended scope, leading to inappropriate workflow guidance, routing errors, or unexpected handling of unrelated tasks.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger keywords are extremely broad, including common terms like 'nano', 'banana', 'pro', 'generate', 'edit', and 'images'. This can cause the skill to activate for unrelated user requests, leading to incorrect routing, unintended instruction injection into benign conversations, and reduced user control over which skill is invoked.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger sentence is overly broad and can activate on generic user phrasing, causing the skill to be invoked outside its intended Nano Banana workflow context. This creates prompt-routing risk: unrelated requests may be captured, leading to inappropriate behavior, reduced reliability, or accidental exposure of skill-specific instructions in contexts where they do not belong.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger examples use very broad, natural-language phrases such as 'Help me' and 'I need a practical workflow', which are common in ordinary conversations and can cause the skill to activate unintentionally. In an agent ecosystem, accidental invocation can route user requests into the wrong workflow, causing confusion, inappropriate actions, or undesired handling of unrelated tasks.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This file is entirely presented in Simplified Chinese and does not indicate that language choice is optional or user-selected. That can violate language/locale policy when a skill appears to impose a specific locale without opt-in or a documented region-specific reason.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The example trigger sentences are truncated, repetitive, and do not show meaningful boundaries between valid and invalid invocations. Poor examples make it easier for users or calling systems to overgeneralize activation conditions, increasing accidental triggering and misuse in adjacent but unsupported contexts.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill description says it should be used when users mention broad terms like work-productivity, nano, banana, or pro, but it does not clearly define boundaries for when the skill should or should not activate. Ambiguous activation criteria increase the chance of accidental invocation and inappropriate application of the skill to unrelated tasks.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 77% confidence
Finding: 该技能文件为 SKILL.zh-CN.md，主体内容为中文，但触发关键词和示例句主要使用英文，且未说明是否支持用户按其偏好选择语言。按规则，若技能对语言/locale 有隐含约束且无用户 opt-in，属于自然语言策略风险。
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The display description and default prompt use very broad activation language such as general work-productivity terms, 'practical workflow,' 'artifact,' 'checklist,' and 'implementation support.' This creates an overbroad match surface that can cause the orchestration layer to select the skill for many unrelated requests, leading to confused-deputy behavior and exposing users to skill behavior outside its intended scope.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Implicit invocation is enabled, but the skill metadata does not define a narrowly scoped trigger. Because the description and prompt are broad, the agent may invoke this skill in situations only loosely related to the intended workflow, increasing the chance of unintended delegation, prompt-surface expansion, or misuse in unrelated contexts.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This trigger remains too generic and lacks a clear decision boundary, so the skill may match broad workflow requests that are unrelated to the intended requirement. In an agent environment, ambiguous activation can cause misrouting, unintended execution paths, and confusion about which skill should handle a request, increasing the chance of unsafe or low-quality outputs.
Content: No source excerpt is available for this finding.