Nano banana

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 12:24 AM UTC
• Version: 3.0.0

Overview

This skill coherently generates or edits images through Google's Gemini image API, with disclosed credential and file use but some credential-handling and dependency hygiene caveats.

Install only if you are comfortable sending prompts and any selected input images to Google's Gemini service and using a Gemini API key. Set `GEMINI_API_KEY` in the environment instead of pasting keys into chat or command-line arguments, and review dependency/version practices if reproducible execution matters.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/generate_image.py:2
• Finding: Unpinned Runtime Dependencies Allow Unreviewed Package Versions<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generate_image.py`, lines 2-7 **Vulnerability Type**: Supply-chain exposure through non-deterministic dependency resolution **Risk Level**: Medium ### Vulnerable Code ```python # /// script # requires-python = ">=3.10" # dependencies = [ # "google-genai>=1.0.0", # "pillow>=10.0.0", # ] # /// ``` The documented execution command in `SKILL.md`, lines 13-17, invokes the script through `uv run`: ```bash uv run ~/.codex/skills/nano-banana-pro/scripts/generate_image.py --prompt "your image description" --filename "output-name.png" [--resolution 1K|2K|4K] [--api-key KEY] ``` ### Technical Analysis Both third-party dependencies use open-ended minimum-version constraints. The project contains no reviewed lockfile or dependency hashes. Consequently, `uv run` can resolve and install a future compatible release whose code was not included in this audit. Python packages can execute code during installation or import. This script imports both dependencies and subsequently gives the Google client access to the API credential, prompt, and optional input image. This does not establish that either current dependency is malicious; the issue is that execution is not reproducible and the effective dependency code can change after review. ### Attack Path 1. An upstream dependency release or configured package source is compromised, or a future compatible release introduces malicious behavior. 2. The user invokes the documented `uv run` command. 3. Dependency resolution selects the affected release because the requirement accepts every version at or above the stated minimum. 4. The package is installed and imported into the process. 5. Malicious package code executes with the same operating-system privileges and environment access as the Agent process. ### Impact Assessment Successful exploitation could expose the `GEMINI_API_KEY`, prompts, input images, and other files or environment variables accessibl ...[truncated 205 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin every dependency to an exact, reviewed version rather than an open-ended minimum version. - Generate and commit a lockfile that records all transitive dependencies. - Require verified package hashes where supported. - Use only a trusted package index and prevent fallback to untrusted indexes. - Regularly scan locked dependencies for known vulnerabilities. - Review and deliberately update the lockfile instead of resolving new versions during ordinary skill execution. - Consider executing image generation in a sandbox with access only to the required input, output directory, and API credential. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_image.py:53
• Finding: Gemini API Key Can Be Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generate_image.py`, lines 53-61 **Vulnerability Type**: Sensitive credential accepted through a command-line argument **Risk Level**: Medium ### Vulnerable Code ```python parser.add_argument( "--api-key", "-k", help="Gemini API key (overrides GEMINI_API_KEY env var)" ) args = parser.parse_args() # Get API key api_key = get_api_key(args.api_key) ``` The option is explicitly recommended in `SKILL.md`, including at lines 13, 17, and 53: ```bash uv run ~/.codex/skills/nano-banana-pro/scripts/generate_image.py --prompt "your image description" --filename "output-name.png" [--resolution 1K|2K|4K] [--api-key KEY] ``` ### Technical Analysis Secrets passed as process arguments may be retained in shell history, terminal transcripts, Agent tool-call records, telemetry, debugging output, or process-accounting systems. Depending on operating-system policy, process arguments may also be observable by other local users while the command is running. Although the implementation does not intentionally print the API key, accepting and documenting `--api-key` places the credential in channels not designed for secret storage. The environment-variable fallback is less likely to appear in process listings, although environment variables also require appropriate process and logging protections. ### Attack Path 1. A user or Agent supplies a Gemini credential using the documented `--api-key` option. 2. The complete command is recorded in shell history, execution logs, transcripts, telemetry, or a process listing. 3. A local user, log reader, monitoring-system operator, or other principal with access to that record retrieves the credential. 4. The principal uses the exposed key to make unauthorized Gemini API requests until the key is revoked or restricted. ### Impact Assessment An attacker obtaining the key could consume the associated Gemini API quota, incur charges where billing is enabled, access API c ...[truncated 262 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the `--api-key` command-line option and its documentation. - Obtain the credential from a dedicated secret manager, operating-system keychain, protected environment injection mechanism, or standard input where appropriate. - Ensure the secret is never included in command logs, Agent transcripts, telemetry, exception messages, or generated files. - Apply restrictive API-key controls, including service restrictions, project restrictions, quotas, and billing alerts. - Rotate any key previously passed on the command line if command histories or execution logs may have retained it. - Redact known credential patterns from operational logs and limit access to historical Agent execution records. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (5)

Memory Manipulation

High

• Category: Memory Poisoning

Content

- Prompt "A serene Japanese garden" → `2025-11-23-14-23-05-japanese-garden.png`
- Prompt "sunset over mountains" → `2025-11-23-15-30-12-sunset-mountains.png`
- Prompt "create an image of a robot" → `2025-11-23-16-45-33-robot.png`
- Unclear context → `2025-11-23-17-12-48-x9k2.png`

## Image Editing

• Confidence: 80% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Credential Access

High

• Category: Privilege Escalation

Content

def get_api_key(provided_key: str | None) -> str | None:
    """Get API key from argument first, then environment."""
    if provided_key:
        return provided_key
    return os.environ.get("GEMINI_API_KEY")

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill invokes a script that can read environment variables for `GEMINI_API_KEY`, but the manifest declares no explicit tool scope or permissions boundary. That weakens auditability and increases the chance the skill is auto-invoked without users understanding it may access secrets from the environment.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The description is broad enough to match many generic image-related requests, which can cause over-triggering of a skill that executes local commands and uses API credentials. In practice this can lead to unintended external API calls, cost exposure, or misuse of local files during image-edit workflows.

Session Persistence

Medium

• Category: Rogue Agent

Content

Examples:
- Prompt "A serene Japanese garden" → `2025-11-23-14-23-05-japanese-garden.png`
- Prompt "sunset over mountains" → `2025-11-23-15-30-12-sunset-mountains.png`
- Prompt "create an image of a robot" → `2025-11-23-16-45-33-robot.png`
- Unclear context → `2025-11-23-17-12-48-x9k2.png`

## Image Editing

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.