Security audit

Work Productivity Nano Banana Workflow Helper

Security checks for vulnerabilities and agentic risk

Overview

This skill is a documentation-style workflow helper with no executable payload, but its activation keywords are too broad and may cause accidental invocation.

Installers should be aware that this skill may activate for ordinary words like generate, edit, pro, or bug fix. It appears safe in terms of code execution and data access, but its triggers should be narrowed if precise skill routing matters.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest description says to use the skill when a user asks for broad terms like "work-productivity," "nano," "banana," "pro," or any practical workflow, artifact, checklist, analysis, or implementation support. That scope is so expansive that the skill could be invoked for many unrelated requests, increasing misrouting risk and allowing this skill to inappropriately capture traffic meant for other tools.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger keyword list includes extremely generic terms like "nano," "banana," "pro," "generate," "edit," and "bug fix," which are common in unrelated user requests. This can cause unintended skill activation, routing users into an irrelevant workflow and potentially overriding better-matched skills or injecting misleading guidance into normal conversations.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger keywords are overly broad and include generic terms such as 'nano', 'banana', 'pro', 'generate', and 'edit', which can match many unrelated user requests. This can cause the skill to activate outside its intended scope, leading to inappropriate routing, confused task handling, and accidental invocation in contexts where its workflow assumptions do not apply.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger sentence is extremely broad and built from common words like 'help me' and generic workflow language, which can cause the skill to activate in unrelated conversations. That creates unintended routing and prompt-scope confusion, increasing the chance that users get the wrong skill behavior or that other protections are bypassed through accidental invocation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger phrases are broad, generic, and include common terms like "nano," "pro," "generate," "edit," and "bug fix," which can cause the skill to activate outside its intended scope. In an agent environment, overbroad activation can misroute user requests, override more appropriate skills, and increase the chance of unintended instruction application or unsafe workflow execution.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger keywords and example invocations are very broad, including generic terms like 'nano', 'pro', 'generate', 'edit', and 'bug fix'. This can cause the skill to activate outside its intended scope, leading to accidental routing, prompt confusion, or misuse in unrelated contexts; in an agent ecosystem, overly permissive activation increases the chance that untrusted or irrelevant requests invoke the skill unexpectedly.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The example trigger sentences are truncated and vague, so they do not clearly show when the skill should or should not activate. Poor examples make downstream routing behavior harder to validate and increase the chance that broad matching logic will treat partial or unrelated phrasing as sufficient to invoke the skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The activation condition in the description is ambiguous because it mixes broad topical words with general requests for 'workflow, artifact, checklist, analysis, or implementation support' without clear boundaries. In practice, this can make the skill eligible for a large set of unrelated tasks, increasing misfires and reducing the reliability and safety of skill selection.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The example trigger phrases reinforce broad activation but do not establish boundaries or provide negative examples, so downstream systems or authors may copy patterns that over-trigger the skill. This increases accidental invocation and weakens confidence that the skill will only run for relevant workflow-support scenarios.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The default prompt uses extremely broad trigger language such as 'help me' and a long list of generic workflow-related tasks, which can cause the skill to be invoked in situations beyond its intended scope. Because implicit invocation is enabled, this ambiguity increases the chance of misrouting user requests, unintended activation, and overexposure of the skill in unrelated contexts.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The invocation description and trigger scope are underspecified, allowing activation on ambiguous terms such as 'nano', 'banana', or 'pro' that appear in many benign contexts. In an agent environment, this can misroute tasks, expose users to irrelevant instructions, and reduce operator control over when the skill is applied.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: This file is a zh-CN README, but the keywords and trigger phrases are written in English and the document does not indicate that users may choose their preferred language. That can amount to an implicit language constraint without opt-in, especially for a localized user-facing skill description.
Content: No source excerpt is available for this finding.