Nano Banana Pro

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 11:21 PM UTC
• Version: 1.0.1

Overview

This skill is a straightforward NanoPhoto image-generation integration, with expected third-party API use and no evidence of hidden persistence, local data access, or deceptive behavior.

Install only if you are comfortable sending image prompts and public edit-image URLs to NanoPhoto.AI. Configure NANOPHOTO_API_KEY through the skill environment, avoid passing it with --api-key on shared or logged systems, and do not submit confidential images or sensitive prompt content unless NanoPhoto's handling of that data is acceptable to you.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/nano_banana_generate.py:25

Finding

Bearer API Key May Be Forwarded Across Origins During HTTP Redirects

Content

View full analysis

Vulnerability Details

File Location: scripts/nano_banana_generate.py, lines 25-38
Vulnerability Type: Credential disclosure through unrestricted HTTP redirects
Risk Level: Medium

python

request = urllib.request.Request(
    url,
    data=body,
    headers={
        "Content-Type": "application/json",
        "Authorization": f"Bearer {api_key}",
        "User-Agent": user_agent,
        "Accept": "application/json, text/plain, */*",
        "Origin": "https://nanophoto.ai",
        "Referer": "https://nanophoto.ai/",
    },
    method="POST",
)
try:
    with urllib.request.urlopen(request, timeout=timeout) as response:

Technical Analysis

The script places the NanoPhoto API key in the Authorization header and submits requests using urllib.request.urlopen. The default urllib opener supports automatic HTTP redirects, while this implementation neither disables redirects nor validates the destination scheme, hostname, port, or origin of a redirected request.

Consequently, a redirect response could move the authenticated request outside the intended https://nanophoto.ai origin. Depending on redirect handling, the bearer credential may be attached to the redirected request. Authentication headers should never be allowed to cross an origin boundary without an explicit security decision.

Exploitation requires an attacker to influence the response from the configured NanoPhoto endpoint, such as through service compromise, DNS or routing compromise, or another condition that permits a malicious redirect. The destination URLs themselves are fixed constants and cannot be directly supplied by an ordinary command-line user, which limits exploitability.

Attack Path

1. The user runs the Skill with a valid NANOPHOTO_API_KEY.
2. The script sends an authenticated request to a fixed NanoPhoto API endpoint.
3. An attacker-controlled or compromised endpoint returns an HTTP redirect ...[truncated 690 chars]

Remediation

View remediation

Remediation Suggestions

• Disable automatic redirects for authenticated API requests and treat redirect responses as errors.
• Alternatively, implement a custom redirect handler that only permits HTTPS destinations whose normalized hostname is exactly nanophoto.ai and whose expected port is used.
• Remove the Authorization header whenever the scheme, host, or port changes.
• Apply a strict redirect-count limit to prevent redirect loops.
• Consider certificate pinning only if the service has an operationally reliable pin-rotation process.
• Add automated tests confirming that bearer credentials are not transmitted to a different origin following 301, 302, 303, 307, or 308 responses.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/nano_banana_generate.py:58

Finding

API Key Can Be Supplied Through a Process-Visible Command-Line Argument

Content

View full analysis

Vulnerability Details

File Location: scripts/nano_banana_generate.py, lines 58-67
Vulnerability Type: Sensitive credential exposure through command-line arguments
Risk Level: Low

python

parser.add_argument("--api-key", help="NanoPhoto API key; defaults to NANOPHOTO_API_KEY env var")
parser.add_argument("--generation-id", help="Skip submission and poll an existing generationId")
parser.add_argument("--json-only", action="store_true", help="Print only raw JSON responses without wrapper stage objects")
parser.add_argument("--user-agent", default=DEFAULT_USER_AGENT, help="HTTP User-Agent override")
parser.add_argument("--poll-interval", type=int, default=5, help="Polling interval in seconds (default: 5)")
parser.add_argument("--timeout", type=int, default=60, help="Per-request timeout in seconds (default: 60)")
parser.add_argument("--max-wait", type=int, default=600, help="Maximum total wait time in seconds (default: 600)")
args = parser.parse_args()

api_key = args.api_key or os.environ.get("NANOPHOTO_API_KEY")

Technical Analysis

The script permits the API key to be passed through --api-key. Command-line arguments can be recorded in shell history, process accounting, terminal logs, debugging output, automation logs, and process metadata. On systems where process arguments are visible to other users or monitoring software, the credential may be exposed while the process is running.

This option conflicts with the project's safer documented recommendation to inject NANOPHOTO_API_KEY through the platform's protected environment-variable configuration. The code does not print the key itself, but accepting it through the command line creates an avoidable local disclosure channel.

Attack Path

1. A user invokes the script with --api-key SECRET_VALUE.
2. The complete command is retained in shell history, an automation log, or process metadata.
3. A local user, monitoring process, support o ...[truncated 672 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the --api-key argument and require NANOPHOTO_API_KEY through the platform's scoped secret-management mechanism.
• Where environment injection is unavailable, read the key interactively with getpass.getpass() or from a permission-restricted credential file.
• Avoid placing secrets in shell commands, examples, logs, exception messages, or generated process invocations.
• If backward compatibility requires retaining --api-key, display a clear warning that the option is insecure and should not be used in shared or logged environments.
• Document API-key rotation and revocation procedures for users who may have previously supplied the key through command-line arguments.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill explicitly requires access to an environment variable containing an API key and performs outbound network calls, but it does not declare a restrictive tool scope such as permissions or allowed-tools. In an agent environment, missing scope declarations can allow broader-than-necessary execution and make review, sandboxing, and policy enforcement harder.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 72% confidence

Finding

The skill sends user prompts, image URLs, and an Authorization bearer token to an external third-party service. While that is expected for this skill's purpose, it is still a real data exfiltration boundary: sensitive prompts or private image URLs may be disclosed externally, and users may not realize the data leaves the local environment.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

Submit generation

bash

curl -X POST "https://nanophoto.ai/api/nano-banana-pro/generate" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $NANOPHOTO_API_KEY" \
  --data-raw '{

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This script transmits sensitive user-supplied content, including prompts and image URLs, plus the API key, to a third-party external service. While that behavior is functionally required for the skill, the lack of any explicit user-facing disclosure or consent mechanism creates a real privacy and data-handling risk, especially if users may provide confidential images or sensitive prompt content without realizing it leaves the local environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.