Security audit

Gemini Image

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real Gemini image-generation skill, but its batch workflow asks the agent to create an hourly cron job and automatically send finished images to chat channels without clear consent boundaries.

Install only if you are comfortable sending prompts and reference images to Google Gemini. Prefer the manual submit/status/download batch commands and keep outputs local. Do not use the automated "batch submit" workflow unless you explicitly approve the cron job, output directory, destination channel, and cleanup behavior.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The documented batch workflow goes beyond image generation by instructing the agent to deliver outputs to external messaging channels automatically. This creates an undisclosed data egress path and expands the skill from local generation into autonomous cross-channel distribution, which can expose generated or user-supplied sensitive content.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Instructing creation of hourly cron jobs adds persistence and recurring execution unrelated to the core image-generation purpose. Persistent scheduled tasks increase the blast radius of mistakes or abuse, and can continue polling, downloading, and sending data long after the original user interaction.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The workflow sends generated images to an originating external channel without an explicit warning or confirmation step. Because prompts and reference images may contain sensitive, proprietary, or personal material, silent outbound delivery can leak data to third-party platforms or unintended recipients.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The workflow directs the agent to create and later remove cron jobs without clearly warning the user about persistent system changes. Hidden scheduled tasks are risky because they alter the host environment, may survive beyond the session, and can be repurposed for repeated execution or unintended background activity.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The script uploads prompts and any referenced local images to Gemini's external Files/Batch APIs without an explicit user-facing disclosure or confirmation at the point of submission. In a batch tool that can ingest arbitrary local file paths from JSONL, this creates a real privacy and data-exfiltration risk if users include sensitive images or do not realize those files leave the local machine.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: This script sends the user's prompt and any referenced input images to Google's Gemini API over the network, but it provides no explicit disclosure or confirmation at the point of transmission. In a local agent/skill context, users may reasonably assume files are processed locally, so silent off-system transfer can expose sensitive images, embedded metadata, or confidential prompt content to a third-party service.

Ssd 3

Medium

Confidence: 96% confidence
Finding: Automatically returning outputs to an external channel can relay transformed versions of user-provided reference images or sensitive content without a final human check. In an image-editing skill, this context makes the issue more dangerous because uploads may include private photos, proprietary designs, or internal mockups that should not be redistributed automatically.

VirusTotal

No VirusTotal findings

View on VirusTotal