Nano Banana Skill

• Analyzed: May 11, 2026, 5:03 AM
• Findings: 1
• Version: 1.0.0
• Hash: f39cfc6be6f6d6f10ea53dec73d3ddf882f81f0ac2818a7860f4545d3b7665aa
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill includes a file upload capability (`curl -F "file=@/path/to/your/image.jpg"`) documented in both SKILL.md and README.md. While intended for uploading reference images to monet.vision, this feature presents a significant vulnerability. If an AI agent's input for the file path is not strictly controlled or sanitized, a malicious prompt could instruct the agent to upload arbitrary local files (e.g., `/etc/passwd`, `~/.ssh/id_rsa`), leading to data exfiltration. This is a risky capability that could be exploited, classifying it as suspicious rather than benign, as it enables a potential attack vector against the agent's host system.