Auto Free Banana

• Outcome: Review
• Latest audit: May 29, 2026 · 9:24 PM UTC
• Version: 1.0.0

Overview

This skill is for Google Flow image generation, but it also reads browser authentication state and saves reusable Google session data locally, so it should be reviewed carefully before use.

Install only if you are comfortable letting the skill open or attach to a Chrome debugging session, read Google Flow and Google account cookies, call Flow session endpoints, and store a reusable OAuth token plus cookies in a local plaintext file. Use a dedicated Chrome profile and account if possible, review the cookie path, and remove the cached cookies.json after use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill exercises environment-variable and network capabilities but does not declare permissions or clearly bound those capabilities. In practice it reads proxy, browser, cookie, and profile settings and performs external connectivity checks and service access, which increases the chance of unintended data exposure or unsafe execution in hosts that rely on declared permissions for sandboxing and user review.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose says this is UI automation for image generation, but the behavior described by analysis includes extracting OAuth/session tokens, persisting cookies/tokens to disk, attaching to Chrome remote debugging, and calling authentication/session endpoints directly. That mismatch is dangerous because users and policy systems may authorize a seemingly low-risk browser automation skill while it actually gains access to highly sensitive authentication material and broader browser state.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code persists a Google access token and browser cookies to a JSON file on disk in plaintext, with no file-permission hardening, encryption, or user disclosure. In the context of browser automation for image generation, these secrets can likely authenticate to the user's Flow/Google session, so local compromise, multi-user systems, backups, or accidental file exposure could lead to account/session hijacking.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This code persists a Google Flow OAuth access token and collected browser cookies to disk via write_cookie_file, creating a reusable credential cache outside the browser's protected storage. If the file is read by another local process, another skill, or exfiltrated later, an attacker can impersonate the user's authenticated session and access Flow-related resources without reauthentication.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The function attaches to a local Chrome DevTools Protocol endpoint, enumerates cookies for labs.google and accounts.google.com, and extracts an OAuth bearer token from page state or authenticated session APIs. This is credential harvesting behavior: it bypasses a normal OAuth flow and silently reuses the user's browser-authenticated session, which is especially dangerous in an automation skill because it can access live user credentials without clear disclosure or consent.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/flow-webapi/utils/load-browser-cookies.ts:152

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/flow-webapi/utils/paths.ts:36

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/flow-webapi/utils/http.ts:41

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/flow-webapi/utils/load-browser-cookies.ts:97

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/flow-webapi/client.ts:55

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/flow-webapi/utils/get-auth-token.ts:74

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/flow-webapi/utils/load-browser-cookies.ts:388