Nano Banana Pro (Morfeo)

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:02 AM UTC
• Version: 1.0.0

Overview

This image-generation skill appears purpose-aligned, but it has review-worthy risks around API-key handling, dependency pinning, and uploading local images to Google.

Install only if you are comfortable sending prompts and any selected input or reference images to Google for processing. Prefer GEMINI_API_KEY over --api-key, avoid sensitive or regulated images unless you have permission, and consider pinning dependencies or running the skill in an isolated environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/generate_image.py:3

Finding

Unpinned Third-Party Dependencies Permit Unreviewed Code Execution

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_image.py:3-7
Vulnerability Type: Unbounded third-party dependency resolution
Risk Level: Medium

Vulnerable Code:

python

# /// script
# requires-python = ">=3.10"
# dependencies = [
#     "google-genai>=1.0.0",
#     "pillow>=10.0.0",
# ]
# ///

Technical Analysis

The inline dependency specification defines only minimum versions for google-genai and pillow. It does not use exact versions, integrity hashes, or a committed lockfile. When the documented uv run command resolves the script environment, it may download and execute any future package version satisfying these constraints.

Consequently, the code executed at runtime is not limited to the dependency versions that were present when the Skill was audited. A compromised upstream release, package index account, distribution artifact, or dependency of either declared package could introduce arbitrary code into the execution environment.

The dependency installation is related to the Skill's image-generation functionality, but resolving unrestricted future releases exceeds the minimum supply-chain trust necessary to perform that function.

Attack Path

1. An attacker compromises an upstream package release process, package index account, or qualifying transitive dependency.
2. The attacker publishes a malicious version satisfying google-genai>=1.0.0 or pillow>=10.0.0.
3. A user invokes the Skill through the documented uv run command in an environment where the malicious version is selected.
4. uv downloads and installs the unreviewed package version.
5. Malicious package code executes during import, initialization, or ordinary runtime operations.
6. The code runs with the same operating-system identity and permissions as the Skill process.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the Agent user's privileges ...[truncated 458 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every direct dependency to an exact, reviewed version rather than using open-ended lower bounds.
• Generate and commit a lockfile that includes all transitive dependencies.
• Require cryptographic artifact hashes where supported.
• Install packages only from a trusted, explicitly configured package index.
• Perform dependency updates through a controlled review and testing process.
• Run the Skill in an isolated environment with access limited to the required images, output directory, and Gemini credential.
• Add automated software-composition analysis and package integrity checks to the release process.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_image.py:105

Finding

Gemini API Key Can Be Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_image.py:105-108
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: Medium

Vulnerable Code:

python

parser.add_argument(
    "--api-key", "-k",
    help="Gemini API key (overrides GEMINI_API_KEY env var)"
)

The corresponding usage documentation explicitly permits this credential-handling pattern:

bash

uv run ~/.clawdbot/skills/nano-banana-pro/scripts/generate_image.py \
  --prompt "your image description" \
  --filename "output-name.png" \
  [--resolution 1K|2K|4K] \
  [--api-key KEY]

Technical Analysis

Command-line arguments are generally not a secure secret-transport mechanism. Depending on the operating system and execution environment, they can be captured in shell history, process listings, Agent tool-call records, terminal logs, audit telemetry, crash reports, or orchestration logs.

Although the script also supports GEMINI_API_KEY, accepting and documenting --api-key encourages users or calling agents to place a live credential directly into observable command metadata. The script does not print the key itself, but preventing direct output does not protect it from command and process-level logging.

Attack Path

1. A user or Agent follows the documented example and supplies a live Gemini key using --api-key.
2. The complete invocation is retained in shell history, Agent execution records, process metadata, monitoring telemetry, or another command log.
3. A local user, administrator, support operator, or party with access to those records retrieves the key.
4. The party uses the exposed credential to submit unauthorized Gemini API requests.
5. Requests consume the victim's quota and inherit whatever API access, project association, and billing scope the credential provides.

Impact Assessment

Exposure may permit unauthorized use of the Gemini API, quota ...[truncated 387 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the --api-key command-line option and its examples from SKILL.md.
• Retrieve the credential from a protected secret manager or a narrowly scoped environment variable supplied by the execution platform.
• If interactive entry is necessary, use a non-echoing secure prompt and avoid persisting the entered value.
• Ensure Agent tool calls, process launch telemetry, and error reports redact credentials.
• Configure the Gemini key with the narrowest available API, project, quota, and billing restrictions.
• Rotate any key that has previously been supplied through command-line arguments or retained in logs.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill description materially understates behavior: it omits reference-image support, conflicts on default resolution, and says not to read image files even though the implementation reads input/reference files before sending them onward. This can mislead operators and users about what data is accessed and transmitted, undermining informed consent and safe routing decisions.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The activation language is extremely broad, covering nearly any request to generate, modify, change, alter, or update images. Overbroad routing increases the chance that unrelated user tasks or sensitive local images are funneled into this skill and then transmitted to an external provider without sufficiently specific intent verification.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_image.py (reported line 38)May include surrounding context.

python

def get_api_key(provided_key: str | None) -> str | None:
    """Get API key from argument first, then environment."""
    if provided_key:
        return provided_key
    return os.environ.get("GEMINI_API_KEY")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill invokes environment-dependent behavior by documenting use of GEMINI_API_KEY and --api-key, but it declares no explicit tool scope or permissions boundary. This weakens reviewability and least-privilege controls, making it easier for the skill to access secrets or capabilities without clear user-facing authorization metadata.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instructions do not warn that prompts and supplied image files will be transmitted to Google's external API. This is a meaningful privacy and data-handling omission because users may provide proprietary, personal, or regulated images assuming local-only processing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction "Provide the optimized prompt in English" forces a specific language regardless of the user's preferred language or locale. This is a natural-language policy issue because it imposes a language choice without offering opt-in or documenting a justified locale restriction.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 231)May include surrounding context.

Style Transfer

bash

uv run ~/.clawdbot/skills/nano-banana-pro/scripts/generate_image.py \
  --prompt "Using the warm golden hour aesthetic from the reference, create a serene Japanese garden with cherry blossoms, koi pond reflecting soft pink petals, traditional wooden bridge, ethereal morning mist, 8k photorealistic detail" \
  --filename "2026-01-28-japanese-garden.png" \
  --reference-image "style-reference.jpg" \
  --reference-type STYLE \

Static analysis

No suspicious patterns detected.