ClawHub
Back to skill

Security audit

Nano Banana Pro (Morfeo)

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a legitimate Google-backed image generation and editing tool, with the main risk being that prompts and chosen images are sent to Google and outputs are saved locally.

Install only if you are comfortable sending prompts and any selected input or reference images to Google for processing. Avoid sensitive personal, confidential, or regulated images unless that upload is acceptable, choose output filenames carefully to avoid overwriting files, and prefer GEMINI_API_KEY over passing an API key directly on the command line.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill instructs use of an API key via --api-key or GEMINI_API_KEY and therefore relies on environment-secret access, yet no explicit permissions are declared. This creates an authorization and transparency gap: an agent may access sensitive environment data without the user clearly understanding that secret material is in scope.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger language is extremely broad and can cause the skill to auto-activate for many generic image-related requests without meaningful user intent confirmation. Overbroad routing increases the chance of unintended external API use, file creation, and transmission of user-provided image data to a third-party service.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The skill directs outputs to the user's current working directory without prominent safeguards about file creation, collisions, or sensitive workspace context. In agent settings, writing into the active workspace can overwrite expected artifacts, create clutter, or place generated content alongside sensitive project files without explicit consent.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The script sends prompts and user-supplied images to Google's external API without any explicit consent notice, redaction step, or privacy warning. In a skill that edits local images directly, users may unknowingly transmit sensitive personal or proprietary data off-host to a third party.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.