Nano Banana 2

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:10 AM UTC
• Version: 0.1.1

Overview

The skill's image-generation purpose is coherent, but its install instructions ask users to execute mutable remote code directly.

Review the installer before running it. Prefer a manual or pinned install path with an independently published checksum or signature, keep login as a separate step after verification, and avoid sending private prompts or proprietary images unless inference.sh's data handling is acceptable to you.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:14

Finding

Unverified Remote Installer Executed Directly by the Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 14
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash

curl -fsSL https://cli.inference.sh | sh && infsh login

Technical Analysis

The quick-start procedure retrieves a mutable shell script from https://cli.inference.sh and pipes it directly into sh. This grants the current remote response arbitrary command-execution capability under the invoking user's account before the user can inspect or independently verify it.

Although the install note states that the script downloads a matching binary and verifies its SHA-256 checksum, this does not establish a secure trust boundary. The bootstrap script itself is neither version-pinned nor checked against a locally specified digest or trusted signature. Because that same script controls the download URL and verification procedure, a compromised or malicious response could remove, bypass, or replace those checks.

Installing a client is relevant to the Skill's image-generation functionality, but executing an unreviewed and mutable installer is not the minimum privilege or minimum trust mechanism required. A version-pinned artifact with independent verification would provide the needed functionality with less supply-chain risk.

Attack Path

1. A user or Agent follows the documented quick-start command.
2. The command contacts cli.inference.sh and accepts the server's current response without version pinning.
3. An attacker compromises the distribution domain, hosting account, deployment pipeline, or another trusted delivery component and substitutes a malicious shell response.
4. sh executes that response immediately with the permissions of the invoking user.
5. The payload can access resources available to that account, alter files or tools, collect credentials, or install additional components.
6. If the installer appears to complete normall ...[truncated 927 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the curl | sh installation pipeline from the quick-start instructions.
2. Pin the CLI to a specific immutable version rather than downloading the latest installer or binary.
3. Download the artifact to a local file as a separate operation.
4. Publish the expected SHA-256 digest in version-controlled Skill documentation and verify it locally before execution. Do not rely solely on a checksum selected or downloaded by the same installer.
5. Prefer signed release artifacts and verify the signature against a pinned, independently distributed public key.
6. Provide transparent manual installation commands showing the exact source, destination, and permissions of every installed file.
7. Run installation without elevated privileges and use a user-owned directory with narrowly scoped permissions.
8. Keep infsh login as a separate, explicit command after installation and verification so authentication never occurs automatically through a newly downloaded executable.
9. Where possible, use a trusted package repository with version locking, integrity metadata, and reproducible release provenance.
10. Pin versions in the optional npx skills add examples as additional supply-chain hardening.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The Quick Start instructs users to pipe a remotely fetched script directly into sh, which is a classic arbitrary code execution anti-pattern. Even with a nearby note about checksum verification, the copy-paste command itself executes unreviewed network content immediately, so compromise of the host, transport, or distribution path could result in code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Quick Start

bash

curl -fsSL https://cli.inference.sh | sh && infsh login

infsh app run google/gemini-3-1-flash-image-preview --input '{"prompt": "a banana in space, photorealistic"}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill describes sending prompts and images to inference.sh and optionally enabling Google Search grounding, but it does not clearly warn users that their text, image inputs, and related data leave the local environment and are transmitted to remote services. This can lead to unintended disclosure of sensitive prompts, proprietary images, or regulated data.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The skill recommends installing and executing a package via npx skills add ... without pinning an exact immutable version. This can expose users to supply-chain risk if the referenced package/tag is updated, compromised, or replaced with malicious content, especially because users are being instructed to execute tooling from a remote registry.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

This example invokes npx skills add with a mutable package reference rather than a pinned version, creating avoidable supply-chain exposure. A future change to the package or tag could cause users to install different code than intended.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

Referencing npx skills add without a pinned version allows execution of whatever content is currently served for that package/tag. In a skill document, this is particularly risky because the text directly encourages copy-paste execution by end users.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.