Nano Banana Pro Cn

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:53 AM UTC
• Version: 1.0.0

Overview

This image-generation skill uses a disclosed third-party API proxy to process prompts and selected images, and I found no hidden persistence, privilege escalation, or unrelated behavior.

Install only if you are comfortable sending image prompts and any selected input images to APIYi and its downstream provider. Prefer a secret environment variable or managed secret for the API key instead of passing it with -k, and avoid using private, confidential, medical, financial, or regulated images or text unless that external processing is acceptable.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

Tainted flow: 'headers' from os.environ.get (line 126, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

print(f"输出请求参数: {json.dumps(payload_log, indent=2, ensure_ascii=False)}")
    print(f"image generation in progress...")
    try:
        response = requests.post(url, headers=headers, json=payload, timeout=400)
        response.raise_for_status()

        data = response.json()

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Ae1

High

• Category: analysis-evasion

Content

- **优先尝试 Node.js 版本**：如果环境有 Node（`node` 命令可用），优先使用 `scripts/generate_image.js`（零依赖，参数与 Python 保持一致）。

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- **优先尝试 Node.js 版本**：如果环境有 Node（`node` 命令可用），优先使用 `scripts/generate_image.js`（零依赖，参数与 Python 保持一致）。

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- **优先尝试 Node.js 版本**：如果环境有 Node（`node` 命令可用），优先使用 `scripts/generate_image.js`（零依赖，参数与 Python 保持一致）。

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- **优先尝试 Node.js 版本**：如果环境有 Node（`node` 命令可用），优先使用 `scripts/generate_image.js`（零依赖，参数与 Python 保持一致）。

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- **优先尝试 Node.js 版本**：如果环境有 Node（`node` 命令可用），优先使用 `scripts/generate_image.js`（零依赖，参数与 Python 保持一致）。

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- **优先尝试 Node.js 版本**：如果环境有 Node（`node` 命令可用），优先使用 `scripts/generate_image.js`（零依赖，参数与 Python 保持一致）。

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- **优先尝试 Node.js 版本**：如果环境有 Node（`node` 命令可用），优先使用 `scripts/generate_image.js`（零依赖，参数与 Python 保持一致）。

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs use of environment variables and outbound network access to a third-party API proxy, but it does not declare an explicit tool scope or allowed-tools boundary. That increases the chance of overbroad execution privileges and makes review, sandboxing, and policy enforcement harder in environments where skills should declare capabilities up front.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger description is broad enough to match many ordinary image-related requests, which can cause the skill to activate unexpectedly and send prompts or images to the external service when the user did not clearly intend that workflow. In this context, accidental activation is more concerning because the skill transmits user content to a third-party proxy.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill description emphasizes convenience and domestic proxy access but does not prominently warn that prompts and uploaded images will be transmitted to a third-party API proxy. Because the skill handles both free-form user text and image inputs, this omission can lead to unintentional disclosure of sensitive personal, proprietary, or regulated data.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The instruction to preserve and reuse the user's full original input encourages forwarding all user-provided text verbatim to the downstream image-generation service. In this skill, that materially increases the risk of leaking sensitive information, hidden instructions, personal data, or confidential business content to the third-party proxy and model provider.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: Passing API keys on the command line can expose secrets through shell history, process listings, logs, and monitoring systems. Including this usage without a strong warning normalizes an unsafe credential-handling practice that can lead to credential theft and unauthorized API usage.

External Transmission

Medium

• Category: Data Exfiltration

Content

const apiKey = getApiKey(args.apiKey);
  const url =
    'https://api.apiyi.com/v1beta/models/gemini-3-pro-image-preview:generateContent';

  const headers = {
    Authorization: `Bearer ${apiKey}`,

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script sends the user prompt and, when used in edit mode, local image contents encoded as base64 to a third-party remote API, but it does not present an explicit privacy or consent warning at the point of transmission. This is risky because users may unknowingly upload sensitive prompts or private local images to an external service, especially in an agent-skill context where local files may be assumed to stay local.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The top-level docstring and CLI help text are written in Chinese, which effectively forces a specific language for interacting with and understanding the skill. The policy allows locale constraints only when users are given a choice or when the restriction is clearly justified, neither of which is present here.

External Transmission

Medium

• Category: Data Exfiltration

Content

api_key = get_api_key(api_key)
    url = (
        "https://api.apiyi.com/v1beta/models/gemini-3-pro-image-preview:generateContent"
    )

    headers = {"Authorization": f"Bearer {api_key}", "Content-Type": "application/json"}

• Confidence: 84% confidence
• Finding: The code is hardwired to send data to https://api.apiyi.com/, a third-party proxy endpoint. Because this skill is specifically designed to upload prompts and image data to that external service, the main risk is privacy and data-governance exposure rather than code execution.

External Transmission

Medium

• Category: Data Exfiltration

Content

print(f"输出请求参数: {json.dumps(payload_log, indent=2, ensure_ascii=False)}")
    print(f"image generation in progress...")
    try:
        response = requests.post(url, headers=headers, json=payload, timeout=400)
        response.raise_for_status()

        data = response.json()

• Confidence: 81% confidence
• Finding: The script transmits user prompts and optionally local image contents to an external third-party proxy service. In a skill context, this can expose sensitive prompt data or private images outside the local environment, especially because the service is a domestic proxy rather than a direct first-party provider.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The file mixes Chinese-only user-facing descriptions and feature text with English trigger phrases, but does not state any language selection or user opt-in policy. This can constitute a language/locale policy issue if the skill presents or expects a fixed language experience without documenting user choice.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger phrases are broad and generic, including common requests like `生成图片`, `图片生成`, and `generate image`, which can cause the skill to activate for a wide range of normal user conversations. In an agent ecosystem, overly broad activation increases the chance of unintended routing to this third-party API-backed skill, potentially exposing user prompts or images to an external service without sufficiently specific user intent.

Intent-Code Divergence

Low

• Confidence: 95% confidence
• Finding: L034-L035 明确写默认图片比例使用 `2K`，而 L152 又写 `-r` 不传时“不在请求中指定，由 API 侧决定”。这不是单纯信息缺失，而是同一技能文档对默认行为给出相互矛盾的说明，可能导致调用方对实际生成参数产生错误预期。

Intent-Code Divergence

Low

• Confidence: 87% confidence
• Finding: L182、L203 说明 API Key 可通过命令行参数提供，L220 还示例使用 `-k`；但 L147-L154 的参数表未列出 `-k`/`--api-key`，前面的执行模板也完全未包含该参数。这会让使用者误判脚本接口能力，属于文档内部对技能行为的矛盾描述。

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The entire markdown file is written in Chinese and presents all usage examples in that language, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-only region or audience. Under the stated policy, a fixed language or locale without opt-in can be a natural-language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: Natural-language instructions, errors, and help output are presented only in Chinese, with no option to select another language. This can violate language/locale policy expectations when a skill imposes a single language without offering user choice or documenting a justified locale restriction.

Intent-Code Divergence

Low

• Confidence: 95% confidence
• Finding: The analyzed file declares the skill name as `nano-banana-pro-clawd`, while the provided manifest context identifies the skill as `nano-banana-pro-cn`. This is an active contradiction in the skill's identifying documentation/metadata and can mislead reviewers about which skill is actually being audited.

Static analysis

No suspicious patterns detected.