ClawHub
Back to skill

Security audit

Nano Banana Pro

Security checks for vulnerabilities and agentic risk

Overview

This image-generation skill is coherent and purpose-aligned, with manageable risks around Google API use, API-key handling, and unpinned Python dependencies.

Install only if you are comfortable sending prompts and any input images to Google's Gemini service. Prefer setting GEMINI_API_KEY through a protected environment or secret manager instead of pasting keys into chat or command lines, and consider pinning dependencies or running the script in an isolated environment for better supply-chain hygiene.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
scripts/generate_image.py:2
Finding

Unpinned Runtime Dependencies Create a Mutable Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: scripts/generate_image.py, lines 2–7
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

python
# /// script
# requires-python = ">=3.10"
# dependencies = [
#     "google-genai>=1.0.0",
#     "pillow>=10.0.0",
# ]
# ///

Technical Analysis

The script declares google-genai and pillow using open-ended minimum-version constraints. The documented uv run workflow can consequently resolve and install future package versions that were not present during this audit.

This makes execution non-reproducible and leaves the skill exposed to upstream package compromise, malicious package releases, or security regressions introduced by later versions. Python packages can execute code during installation or import, and both dependencies are imported by the script during normal operation.

No evidence was found that the currently available versions are malicious. The vulnerability is the absence of version and artifact integrity controls.

Attack Path

  1. An attacker compromises an upstream dependency publisher account, distribution infrastructure, or a future eligible package release.
  2. The attacker publishes a malicious version satisfying google-genai>=1.0.0 or pillow>=10.0.0.
  3. A user runs the documented uv run command in an environment where the malicious eligible version is selected.
  4. The package is downloaded and installed without a reviewed exact-version or hash constraint.
  5. Malicious package code executes during installation or import with the privileges of the invoking user.
  6. The package can access data available to the process, including the Gemini API key, prompts, input images, output files, and other files readable by that user.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the invoking user's account. The accessible scope would include t ...[truncated 317 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace open-ended dependency constraints with exact, reviewed versions.
  2. Generate and commit a lockfile containing fully resolved transitive dependencies.
  3. Require cryptographic hashes for downloaded distributions where supported.
  4. Use a trusted package index or controlled internal mirror rather than allowing arbitrary package sources.
  5. Run dependency installation and image generation under a minimally privileged account or isolated environment.
  6. Review vulnerability advisories and package provenance before applying controlled dependency upgrades.
  7. Ensure automated update tooling does not merge dependency changes without tests and human review.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate_image.py:50
Finding

Gemini API Key Can Be Exposed Through Command-Line Arguments and Chat History

Content
View full analysis

Vulnerability Details

File Location: scripts/generate_image.py, lines 50–53
Related Documentation: SKILL.md, lines 24 and 52–53
Vulnerability Type: Insecure secret handling
Risk Level: Medium

Vulnerable Code

python
parser.add_argument(
    "--api-key", "-k",
    help="Gemini API key (overrides GEMINI_API_KEY env var)"
)

The documentation explicitly supports passing the secret through the command line and recommends using a key supplied in chat:

markdown
[--api-key KEY]
markdown
1. `--api-key` argument (use if user provided key in chat)
2. `GEMINI_API_KEY` environment variable

Technical Analysis

API keys are sensitive credentials and should not be transmitted through ordinary command-line arguments or retained in conversational history. Command-line arguments may be exposed through process inspection, shell history, terminal logging, command auditing, telemetry, orchestration metadata, or diagnostic output. A key supplied in chat may also be retained in conversation records or exposed to systems and personnel with access to those records.

Although the script does not intentionally print the key, accepting it as --api-key places the plaintext credential in the process argument vector. The documentation increases the exposure risk by explicitly instructing users to provide a key through chat.

Attack Path

  1. A user sends a Gemini API key in chat or invokes the script with --api-key KEY.
  2. The plaintext key is retained in chat history, shell history, process metadata, command auditing, or platform telemetry.
  3. Another local user, process, administrator, support operator, or party with access to retained logs retrieves the credential.
  4. The unauthorized party submits requests to Gemini using the stolen key.
  5. The attacker consumes the victim's quota and exercises whatever Gemini API permissions are associated with that credential until it ...[truncated 590 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the --api-key command-line option and all instructions encouraging users to provide secrets in chat.
  2. Obtain the key from a secret manager, protected credential file, or controlled environment injection mechanism.
  3. If interactive entry is necessary, use a non-echoing prompt such as Python's getpass rather than a command-line argument.
  4. Prevent credentials from being included in logs, telemetry, exception messages, and generated command examples.
  5. Restrict secret storage permissions to the account running the skill.
  6. Use narrowly scoped credentials with quota limits and rotate them regularly.
  7. Immediately revoke and replace any key previously disclosed through chat or command history.
  8. Document a secure credential setup procedure that does not expose plaintext secrets in conversational or process metadata.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (5)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md
- Prompt "A serene Japanese garden" → `2025-11-23-14-23-05-japanese-garden.png`
- Prompt "sunset over mountains" → `2025-11-23-15-30-12-sunset-mountains.png`
- Prompt "create an image of a robot" → `2025-11-23-16-45-33-robot.png`
- Unclear context → `2025-11-23-17-12-48-x9k2.png`

## Image Editing

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_image.py (reported line 23)May include surrounding context.

python
def get_api_key(provided_key: str | None) -> str | None:
    """Get API key from argument first, then environment."""
    if provided_key:
        return provided_key
    return os.environ.get("GEMINI_API_KEY")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill invokes a script that can consume environment variables, specifically GEMINI_API_KEY, yet the manifest declares no explicit tool scope or permissions. That weakens isolation and reviewability because users and orchestrators are not clearly informed that secret-bearing environment access is part of the skill's operation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill states it uses Google's Nano Banana Pro API but does not explicitly warn that prompts and any --input-image content are transmitted to an external Google service. Users may unknowingly send sensitive text or private images off-box, creating privacy, compliance, and data-handling risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md
Examples:
- Prompt "A serene Japanese garden" → `2025-11-23-14-23-05-japanese-garden.png`
- Prompt "sunset over mountains" → `2025-11-23-15-30-12-sunset-mountains.png`
- Prompt "create an image of a robot" → `2025-11-23-16-45-33-robot.png`
- Unclear context → `2025-11-23-17-12-48-x9k2.png`

## Image Editing

Static analysis

No suspicious patterns detected.