ClawHub
Back to skill

Security audit

Nano Banana Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Monet image-generation API skill, but users should treat prompts, uploaded files, and the API key as sensitive.

Install only if you are comfortable sending prompts, reference image URLs, and any uploaded image files to monet.vision under your Monet account. Remove the -v flag from the upload example, avoid putting sensitive files or secrets in prompts, and keep MONET_API_KEY out of logs and shared transcripts.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:326
Finding

Verbose curl output can disclose the Monet API bearer token in SKILL.md

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
README.md:176
Finding

Verbose curl output can disclose the Monet API bearer token in README.md

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 42)May include surrounding context.

Your First Image Generation Task

bash
curl -X POST https://monet.vision/api/v1/tasks/async \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $MONET_API_KEY" \
  -d '{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README instructs users to upload a local file to a remote API but does not clearly warn that local file contents will be transmitted off-device to a third-party service. In an agent skill context, this is security-relevant because agents may handle sensitive local images or documents, and users may not realize the privacy and data-handling implications.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 188)May include surrounding context.

Upload a file to get an online access URL.

📁 File Storage: Uploaded files are stored for 24 hours and will be automatically deleted after expiration.

bash
curl -X POST https://monet.vision/api/v1/files \

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 325)May include surrounding context.

Upload a file to get an online access URL.

📁 File Storage: Uploaded files are stored for 24 hours and will be automatically deleted after expiration.

bash
curl -X POST https://monet.vision/api/v1/files \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 257)May include surrounding context.

Example 1: Basic Image Generation

typescript
const response = await fetch('https://monet.vision/api/v1/tasks/async', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 281)May include surrounding context.

Example 1: Basic Image Generation

typescript
const response = await fetch('https://monet.vision/api/v1/tasks/async', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 310)May include surrounding context.

Example 1: Basic Image Generation

typescript
const response = await fetch('https://monet.vision/api/v1/tasks/async', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

This example sends prompts and authentication credentials to an external service, which is an external data transmission path. While expected for an API integration skill, it is still security-relevant because prompts, reference image URLs, and task metadata may contain sensitive information and the skill does not emphasize consent, minimization, or data classification before sending them off-system.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

Create an Image Generation Task

bash
curl -X POST https://monet.vision/api/v1/tasks/async \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $MONET_API_KEY" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

This second API example repeats the same external transmission behavior in the formal API reference, reinforcing a workflow where user-provided content is sent to a third-party endpoint. The danger is contextual rather than inherently malicious: an agent following the documentation could transmit sensitive prompts or image references externally without sufficient user awareness.

Content

Scanner excerpt · SKILL.md (reported line 205)May include surrounding context.

Request:

bash
curl -X POST https://monet.vision/api/v1/tasks/async \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $MONET_API_KEY" \
  -d '{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly instructs users to upload local image files to a third-party API but does not clearly warn that those files leave the local system, are stored remotely, and may contain sensitive personal or proprietary content. In an agent context, this omission can cause unintended exfiltration of user data because operators may treat file uploads as routine without understanding the privacy consequences.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.