Nano Banana Pro Cn

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:31 PM UTC
• Version:
  1.0.0

Overview

This is a disclosed image generation/editing skill that sends prompts and chosen images to APIYI and saves the returned image locally.

Install only if you are comfortable sending prompts and any selected input images to APIYI for processing. Prefer APIYI_API_KEY over passing the key on the command line, use a dedicated API key, and avoid confidential or regulated images unless APIYI's terms and retention practices are acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill instructs the agent to access environment variables and make outbound network requests to a third-party proxy API, but no permissions are explicitly declared. This creates a transparency and policy-enforcement gap: an agent or reviewer may not realize the skill can exfiltrate prompt content, local image data, or API secrets to an external service.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The script metadata and comments describe the skill as using NanoBananaPro, but the code actually calls a Gemini 3 Pro image-preview endpoint. This kind of service-identity mismatch is a real security and trust issue because operators may approve the skill under false assumptions about the backend, data handling, model behavior, or compliance boundaries while prompts, images, and API keys are sent to a different service than advertised.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The CLI help text reinforces a misleading statement about the underlying model/service, which can cause users to submit sensitive prompts or images believing they are using the manifest-described service. In a skill that uploads user-supplied images to a remote API, inaccurate service identification materially affects informed consent, auditability, and supply-chain transparency.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script sends user prompts and optional local images to a remote third-party API, but it does not provide a clear privacy or data-transfer warning at runtime. In this skill context, users may supply sensitive images or confidential text, so silent transmission to an external provider can cause unintended data disclosure.

VirusTotal

66/66 vendors flagged this skill as clean.