Nano Banana Image Creator

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:19 PM UTC
• Version: 1.0.0

Overview

This image-generation skill is coherent and purpose-aligned, but users should avoid sharing API keys in chat or command-line arguments and should treat prompts and input images as sent to Google.

Install only if you are comfortable using Google's image API for the prompts and images you provide. Prefer setting GEMINI_API_KEY through your environment or a secret manager instead of pasting keys into chat or command lines, and avoid submitting confidential images or text unless you accept that external processing.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/generate_image.py:2

Finding

Unbounded Third-Party Dependency Resolution

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_image.py:2-7
Vulnerability Type: Supply-chain exposure through unbounded dependency versions
Risk Level: Medium

python

# /// script
# requires-python = ">=3.10"
# dependencies = [
#     "google-genai>=1.0.0",
#     "pillow>=10.0.0",
# ]
# ///

Technical Analysis

The script declares google-genai and pillow using only minimum-version constraints. There is no exact version pinning, lockfile, package hash, or upper version boundary. The documented uv run workflow can therefore resolve and install future package versions that were not included in this audit.

Python packages can execute code during installation or when imported. Because the script imports these dependencies after obtaining the Gemini API key, a compromised or malicious future dependency release could access the process environment, API credentials, prompts, input images, and files available to the invoking user.

This finding does not establish that the currently available dependencies are malicious. The vulnerability is that the reviewed project does not deterministically constrain the third-party code that will execute.

Attack Path

1. An attacker compromises the distribution account or release process of a permitted dependency, or otherwise causes a malicious version to be served by the configured package source.
2. The attacker publishes a version satisfying google-genai>=1.0.0 or pillow>=10.0.0.
3. A user invokes the documented uv run command in an environment without a previously locked and verified dependency set.
4. uv resolves and installs the malicious or compromised release.
5. Malicious code executes during installation or import with the permissions of the invoking user.
6. The dependency can read the Gemini API key and other process-accessible data, modify files, or make unauthorized network requests.

Impact Assessment

Exploitatio ...[truncated 654 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each dependency to an exact, reviewed version rather than using minimum-version constraints.
2. Generate and commit a lockfile that records the complete transitive dependency graph.
3. Require cryptographic hashes for downloaded distributions where supported.
4. Use only trusted, explicitly configured package indexes and disable unintended fallback indexes.
5. Perform dependency vulnerability and provenance scanning before updating pinned versions.
6. Review lockfile changes as security-sensitive code changes.
7. Execute image generation with least privilege and expose only the credentials and files needed for the current operation.

A hardened declaration should use reviewed exact versions, with the specific versions selected according to the project's tested release baseline:

python

# dependencies = [
#     "google-genai==REVIEWED_VERSION",
#     "pillow==REVIEWED_VERSION",
# ]

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_image.py:47

Finding

Gemini API Key Accepted Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_image.py:47-50
Additional Documentation Locations: SKILL.md:14, SKILL.md:20, SKILL.md:50
Vulnerability Type: Sensitive credential exposure through process arguments, shell history, and chat transcripts
Risk Level: Medium

python

parser.add_argument(
    "--api-key", "-k",
    help="Gemini API key (overrides GEMINI_API_KEY env var)"
)

The key is then selected before the external client is initialized:

python

def get_api_key(provided_key: str | None) -> str | None:
    """Get API key from argument first, then environment."""
    if provided_key:
        return provided_key
    return os.environ.get("GEMINI_API_KEY")

The documentation explicitly presents command-line key usage:

bash

uv run ~/.codex/skills/nano-banana-pro/scripts/generate_image.py --prompt "your image description" --filename "output-name.png" [--resolution 1K|2K|4K] [--api-key KEY]

It also instructs the agent to use a key supplied through chat:

text

1. `--api-key` argument (use if user provided key in chat)
2. `GEMINI_API_KEY` environment variable

Technical Analysis

Secrets passed as command-line arguments can be retained in shell history and captured by terminal recording, command auditing, CI/CD logs, process telemetry, or automation logs. Depending on the operating system and process-inspection permissions, command-line arguments may also be visible to other local users or monitoring services while the process is running.

The recommendation to use a key provided in chat creates an additional exposure channel because the credential may remain in conversation transcripts, application logs, or platform retention systems.

The script does not print the API key itself, and exposure through process inspection depends on the host operating system and its access controls. Nevertheless, accepting and documenting plaintext ...[truncated 1320 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the --api-key command-line option or clearly deprecate it.
2. Do not instruct users to submit API keys through chat.
3. Retrieve credentials from a protected environment-injection mechanism or operating-system secret store.
4. If interactive entry is necessary, use a non-echoing prompt such as Python's getpass rather than a normal command-line argument.
5. Ensure CI/CD systems inject the credential through their native secret-management facilities and redact it from logs.
6. Apply provider-side restrictions, minimum required permissions, usage limits, and key rotation policies.
7. Update SKILL.md to state that credentials must never be included in prompts, chat messages, filenames, or command-line arguments.
8. Revoke and rotate any key that has already been shared through chat or persisted in command history.

The preferred lookup flow should accept only a securely injected value, for example:

python

def get_api_key() -> str | None:
    return os.environ.get("GEMINI_API_KEY")

For higher-assurance deployments, replace environment-based storage with a dedicated secret manager and provide the credential only to the image-generation process for the duration of the request.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (5)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md

- Prompt "A serene Japanese garden" → `2025-11-23-14-23-05-japanese-garden.png`
- Prompt "sunset over mountains" → `2025-11-23-15-30-12-sunset-mountains.png`
- Prompt "create an image of a robot" → `2025-11-23-16-45-33-robot.png`
- Unclear context → `2025-11-23-17-12-48-x9k2.png`

## Image Editing

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_image.py (reported line 23)May include surrounding context.

python

def get_api_key(provided_key: str | None) -> str | None:
    """Get API key from argument first, then environment."""
    if provided_key:
        return provided_key
    return os.environ.get("GEMINI_API_KEY")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill instructs use of environment variables and command execution but does not declare an explicit tool scope such as permissions or allowed-tools. That increases the chance an agent can access environment secrets like GEMINI_API_KEY or invoke commands without clear user-visible constraints, which weakens least-privilege controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill sends user prompts and possibly local input images to Google's external API, but the description does not warn users that their data leaves the local environment. This can lead to unintentional disclosure of sensitive text, proprietary images, or personal information to a third-party processor.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md

Examples:
- Prompt "A serene Japanese garden" → `2025-11-23-14-23-05-japanese-garden.png`
- Prompt "sunset over mountains" → `2025-11-23-15-30-12-sunset-mountains.png`
- Prompt "create an image of a robot" → `2025-11-23-16-45-33-robot.png`
- Unclear context → `2025-11-23-17-12-48-x9k2.png`

## Image Editing