YouTube Thumbnail Generator with Nano Banana

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 8:42 AM UTC
• Version: 0.1.1

Overview

This skill coherently generates YouTube thumbnail plans and optional images using Gemini, with expected network and file output behavior disclosed in its artifacts.

Before installing, confirm you are comfortable sending thumbnail copy and prompts to Google Gemini and writing generated JSON/PNG files locally. Keep the Gemini or Google API key secret and avoid using sensitive unpublished material as input unless that data is allowed to leave your environment.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (11)

Tainted flow: 'request' from os.getenv (line 116, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

for attempt in range(retries + 1):
        request = urllib.request.Request(url, data=data, headers=headers, method="POST")
        try:
            with urllib.request.urlopen(request, timeout=timeout) as response:
                return json.loads(response.read().decode("utf-8"))
        except urllib.error.HTTPError as exc:
            body = exc.read().decode("utf-8", errors="replace")

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises capabilities that can access environment variables, invoke shell commands, write files, and make network requests, but it does not declare an explicit tool scope or permissions boundary. That makes it easier for an agent to over-grant execution authority and increases the chance that user content is sent to external APIs or written locally without a clear contract.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The manifest description says to use the skill when Codex needs a 'YouTube thumbnail generator,' 'thumbnail prompt generator,' or related workflow, but it does not define clear boundaries or exclusion conditions for when the skill should not activate. These phrases are broad enough to match many ordinary content-creation requests, increasing the chance of unintended invocation.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs use of scripts that send prompts and source copy to Gemini/Nano Banana and save outputs locally, but it does not clearly warn that user-provided content may be transmitted to third-party services and artifacts will be created on disk. In a real agent setting, this can lead to silent data disclosure and unexpected local side effects, especially if the input contains proprietary marketing copy or sensitive drafts.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The success schema explicitly labels the generated prompt as a "Final English prompt," which indicates a fixed language requirement. Because the document does not offer a language choice or justify an English-only constraint, this is a natural-language locale policy concern.

Tainted flow: 'image_bytes' from os.getenv (line 202, credential/environment) → pathlib.Path.write_bytes (file write)

Medium

• Category: Data Flow

Content

) -> None:
    output_path.parent.mkdir(parents=True, exist_ok=True)
    metadata_path.parent.mkdir(parents=True, exist_ok=True)
    output_path.write_bytes(image_bytes)
    metadata_path.write_text(
        json.dumps(metadata, ensure_ascii=False, indent=2) + "\n",
        encoding="utf-8",

• Confidence: 65% confidence
• Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Tainted flow: 'metadata' from os.getenv (line 207, credential/environment) → pathlib.Path.write_text (file write)

Medium

• Category: Data Flow

Content

output_path.parent.mkdir(parents=True, exist_ok=True)
    metadata_path.parent.mkdir(parents=True, exist_ok=True)
    output_path.write_bytes(image_bytes)
    metadata_path.write_text(
        json.dumps(metadata, ensure_ascii=False, indent=2) + "\n",
        encoding="utf-8",
    )

• Confidence: 65% confidence
• Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run(*args: str) -> subprocess.CompletedProcess[str]:
    return subprocess.run(
        [sys.executable, str(ENTRYPOINT), *args],
        cwd=ROOT,
        check=False,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The command examples write JSON and PNG artifacts into an outputs directory but do not state whether existing files may be overwritten or whether the directory will be created or modified. This is a lower-severity issue than data exfiltration, but it can still cause unintended file system changes and confusion for users operating in shared or sensitive workspaces.

Missing User Warnings

Low

• Confidence: 76% confidence
• Finding: This markdown file instructs users to set `GEMINI_API_KEY` or `GOOGLE_API_KEY`, which involves sensitive credentials, but it provides no warning about secure handling, exposure risks, or avoiding logging/sharing those values. Under the markdown-file criteria for missing user warnings, credential-related behavior that could affect privacy or system security should be disclosed.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: This code file contains a natural-language instruction requiring the final image prompt to be written in English. That imposes a specific language choice regardless of user preference, and the file does not offer a locale option or explain a region-specific need for English.

Static analysis

No suspicious patterns detected.