nano-banana-v2-openrouter

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:10 AM UTC
• Version: 0.0.1

Overview

This image-generation skill is purpose-aligned, but it tells users to pass an OpenRouter API key through chat or command-line arguments, which can expose the key.

Install only if you are comfortable sending prompts and any edited input images to OpenRouter. Prefer setting `OPENROUTER_API_KEY` in the environment or a secret manager, do not paste the key into chat, and avoid using the `--api-key` command-line option because it may appear in logs or process metadata.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_image.py:91

Finding

API Key Exposure Through Chat and Command-Line Arguments

Content

View full analysis

`. 3. The secret is retained in conversation records, execution logs, shell history, telemetry, or process metadata. 4. An attacker with access to one of those records or to local process inspect ...[truncated 672 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/generate_image.py:3

Finding

Mutable Runtime Dependencies Without Integrity Pinning

Content

View full analysis

=3.10" # dependencies = [ # "requests>=2.28.0", # "pillow>=10.0.0", # ] ``` ### Technical Analysis The inline dependency declaration specifies only minimum versions. Running the script through `uv run` can therefore resolve newer compatible releases that were not part of the audited artifact. The project contains no reviewed lockfile, exact version constraints, dependency hashes, or explicit package-index restrictions. This does not establish that `requests`, Pillow, or their current releases are malicious. The risk is that the effective code executed by the Skill can change after review if a later package release or package-distribution account is compromised. Dependency installation and imported package initialization execute with the same local privileges as the Skill. ### Attack Path 1. A future compatible dependency release is compromised, or its distribution account or configured package source is taken over. 2. A user runs the Skill with `uv run`. 3. Dependency resolution selects the affected release because the declaration allows any version at or above the stated minimum. 4. The package is installed and imported by the script. 5. Malicious package code executes with the privileges and environment available to the Skill process. This is a contingent supply-chain attack path; no malicious dependency was identified in the audited files. ### Impact Assessment A compromised dependency could read files accessible to the invoking user, access environment variables such as `OPENROUTER_API_KEY`, alter generated outputs, make unauthorized network requests, or execute arbitrary code under the Skill process's operating-system account. It would not inherently provide privileges beyond those already granted to that account. ]]>

Remediation

View remediation

", # "pillow==", # ] ``` The placeholders should be replaced with versions verified by the project maintainer and synchronized with a committed lockfile. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

md

- Prompt "A serene Japanese garden" → `2026-03-19-14-23-05-japanese-garden.png`
- Prompt "sunset over mountains" → `2026-03-19-15-30-12-sunset-mountains.png`
- Prompt "create an image of a robot" → `2026-03-19-16-45-33-robot.png`
- Unclear context → `2026-03-19-17-12-48-x9k2.png`

## Image Editing

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill invokes a networked script and depends on an environment secret (OPENROUTER_API_KEY), but the manifest does not declare an explicit tool scope such as permissions or allowed-tools. That creates a governance gap: an agent may expose network and secret access without clear least-privilege boundaries or review metadata, increasing the chance of unintended data egress or overbroad execution.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_image.py (reported line 160)May include surrounding context.

python

}

    try:
        response = requests.post(
            OPENROUTER_API_URL,
            json=request_body,
            headers=headers,