Nano Banana 2

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 12:38 AM UTC
• Version: 1.0.0

Overview

This is a disclosed NanoPhoto image-generation skill with expected external API use and a minor caution around how API keys are supplied.

Install only if you intend to send prompts and public image URLs to NanoPhoto.AI and spend NanoPhoto credits. Configure NANOPHOTO_API_KEY through the platform's secure environment setting or the documented config path, avoid passing it with --api-key, and do not submit private images, sensitive prompts, or non-public URLs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/nano_banana_2.py:163

Finding

API Key Exposure Through Command-Line Arguments

Content

View full analysis

Optional[str]: return explicit_api_key or os.environ.get(ENV_KEY_NAME) or load_api_key_from_openclaw_config() ``` ```python def add_common_auth_args(parser: argparse.ArgumentParser) -> None: parser.add_argument("--api-key", help="NanoPhoto API key") parser.add_argument("--timeout", type=int, default=60, help="Per-request timeout in seconds (default: 60)") parser.add_argument("--user-agent", default=DEFAULT_USER_AGENT, help="HTTP User-Agent override") ``` ```python api_key = resolve_api_key(getattr(args, "api_key", None)) if not api_key: fail("Missing API key. Pass --api-key, set NANOPHOTO_API_KEY, or configure ~/.openclaw/openclaw.json skills.entries.nano-banana-2.env.NANOPHOTO_API_KEY.") ``` ### Technical Analysis The script explicitly accepts the NanoPhoto API key through the `--api-key` command-line option and prioritizes that value during credential resolution. A command such as: ```bash python3 scripts/nano_banana_2.py submit --api-key SECRET_VALUE --prompt "Example" ``` places the credential in the process command line. Depending on the operating system and runtime environment, command-line arguments may be exposed through process inspection facilities, process-monitoring software, audit logs, shell history, terminal logging, job metadata, or diagnostic reports. The project already supports safer credential sources through the `NANOPHOTO_API_KEY` environment variable and the OpenClaw configuration file. Consequently, accepting the credential directly through an ordinary command-line argument is unnecessary and increases the credential exposure surface. The key is legitimately transmitted as an HTTPS Bearer token to the documented Nan ...[truncated 1481 chars]

Remediation

View remediation

Optional[str]: return os.environ.get(ENV_KEY_NAME) or load_api_key_from_openclaw_config() ``` The parser should omit `--api-key`, and the call site should use: ```python api_key = resolve_api_key() if not api_key: fail( "Missing API key. Set NANOPHOTO_API_KEY or configure " "~/.openclaw/openclaw.json skills.entries.nano-banana-2.env.NANOPHOTO_API_KEY." ) ``` ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill documentation instructs use of environment variables, local config file reads, and outbound network access, but it does not declare any explicit tool scope or allowed-tools permissions. This creates a least-privilege gap: an agent runtime may grant broader capabilities than users expect, increasing the chance that credentials or local files are accessed or transmitted without clear policy boundaries.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.

Submit generation

bash

curl -X POST "https://nanophoto.ai/api/nano-banana-2/generate" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $NANOPHOTO_API_KEY" \
  --data-raw '{

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation explicitly instructs users to send free-form prompts and public image URLs to a third-party API, but it does not warn that these inputs leave the local environment and may contain sensitive personal, proprietary, or regulated data. In this skill context, that omission is meaningful because image prompts and source image URLs can easily encode private content, and the optional Google Search enhancement further increases external data disclosure expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.