ClawHub
Back to skill

Security audit

Gemini Nano Images

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly generates Gemini images and captions as described, but it also includes under-scoped instructions for running separate Instagram posting automation.

Review this skill before installing if you only wanted image generation. Use GEMINI_API_KEY rather than --api-key, avoid sensitive personal prompts, install dependencies in an isolated environment, and do not run the ig-automation smart_poster_v4.py commands unless you have separately reviewed that posting tool and are comfortable with automated Instagram account activity.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:122
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:122-126; references/gemini_api.md:13-16
Vulnerability Type: Unpinned package installation
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md:122-126:

bash
## Requirements

```bash
pip install google-genai
text

`references/gemini_api.md:13-16`:

```bash
Install:
```bash
pip install google-genai
text

### Technical Analysis

The installation instructions retrieve the latest available version of `google-genai` and its transitive dependencies without a version constraint or integrity hash. Consequently, installations are not reproducible, and the exact code installed can change after this Skill has been audited.

If a future dependency release or transitive dependency is compromised, malicious code could execute during package installation or when the scripts import and use the package. The package name itself does not appear to be a typosquat; the risk arises from unconstrained supply-chain resolution rather than evidence that the currently published package is malicious.

### Attack Path

1. An attacker compromises a future release of `google-genai` or one of its transitive dependencies.
2. A user follows the documented `pip install google-genai` instruction.
3. Pip resolves and installs the compromised release because no approved version or hash is specified.
4. Malicious package code executes during installation or when either script imports the dependency.
5. The code operates with the privileges of the user running pip or the Skill.

### Impact Assessment

Successful exploitation could permit arbitrary code execution with the invoking user's privileges. Depending on that user's access, the compromised dependency could read user-accessible files and environment variables, including `GEMINI_API_KEY`, alter generated content, make network requests, or modify files in writable locations.

The project does not instruct us
...[truncated 200 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin google-genai to a reviewed, compatible version, preferably using an exact version constraint.
  2. Maintain a lock file that records all resolved transitive dependency versions.
  3. Use hash verification, such as pip install --require-hashes -r requirements.txt, to prevent installation of unapproved artifacts.
  4. Install dependencies in a dedicated virtual environment rather than the system Python environment.
  5. Integrate dependency vulnerability and provenance scanning into the release process.
  6. Periodically review and deliberately update pinned versions after testing rather than resolving the latest release during every installation.

T09 · Insecure Skill Coding Practices

Note
Location
scripts/generate_image.py:118
Finding

Gemini API Key Accepted Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/generate_image.py:118-121; scripts/generate_instagram_post.py:153-156
Vulnerability Type: Sensitive credential exposure through process arguments and shell history
Risk Level: Low

Vulnerable Code Snippets

scripts/generate_image.py:118-121:

python
parser.add_argument(
    "-k", "--api-key",
    help="Gemini API key (or set GEMINI_API_KEY env var)"
)

scripts/generate_instagram_post.py:153-156:

python
parser.add_argument(
    "-k", "--api-key",
    help="Gemini API key"
)

The supplied values are subsequently passed into the generation functions:

python
image_path = generate_image(
    prompt=args.prompt,
    output_dir=args.output,
    api_key=args.api_key
)
python
result = generate_instagram_content(
    topic=args.topic,
    mood=args.mood,
    output_dir=os.path.expanduser(args.output),
    api_key=args.api_key
)

Technical Analysis

Both scripts permit users to place a Gemini API key directly in the command line through --api-key. Command-line arguments can be retained in shell history, captured in terminal or automation logs, and exposed through process inspection facilities while the command is running.

The scripts also support GEMINI_API_KEY, which is preferable to a command-line argument but can still be exposed if the surrounding environment is logged or inherited by untrusted child processes. No hardcoded credential was found, and the reviewed code passes the key to genai.Client; it does not explicitly send the key to any unrelated destination.

Attack Path

  1. A user invokes a script with a command such as python3 scripts/generate_image.py "prompt" --api-key SECRET.
  2. The complete command is recorded in shell history, CI logs, process telemetry, or another command-capture mechanism.
  3. A local user or a party with access to those records retrieves th ...[truncated 860 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the -k and --api-key command-line options from both scripts.
  2. Read the credential from GEMINI_API_KEY, a protected configuration file, an operating-system keyring, or a secret manager.
  3. If interactive credential entry is necessary, use getpass.getpass() so the value is not echoed or included in process arguments.
  4. Ensure secret files are excluded from version control and restricted to the owning user.
  5. Redact environment variables and command invocations in CI, terminal capture, and application telemetry.
  6. Apply API-key restrictions, usage quotas, and billing alerts where supported.
  7. Rotate any key that has previously been supplied through command-line arguments or retained in logs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The core image-generation portion of the description broadly matches the code: it calls Gemini image generation, aims for photorealistic/social-media-suitable output, and saves the image. However, the description materially overstates capabilities by claiming complete Instagram content creation, including captions, which is absent from the implementation. There is also a concrete model mismatch: the description says Gemini 2.0 Flash Experimental, while the code invokes 'gemini-2.5-flash-image'. The unused --style flag is a smaller implementation inconsistency, but the missing caption/post-generation functionality is the main reason this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The code generally aligns with the declared Instagram-content-generation purpose: it creates an image and a caption for an Instagram post. However, there are material discrepancies. The description explicitly claims Gemini 2.0 Flash Experimental, while the implementation uses gemini-2.5-flash-image and gemini-2.5-flash. The description also says it supports standalone image generation, but this code chunk only implements combined Instagram post generation with both image and caption. Additionally, the script saves outputs to local files and directories, which is an undeclared resource interaction. These differences are sufficient to flag a description-versus-behavior mismatch, even though the overall theme of Instagram content generation is consistent.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill documentation describes capabilities that use environment variables and write files, but the skill does not declare any explicit tool scope or permissions boundary. This creates a transparency and governance gap: an agent or reviewer cannot easily tell that the skill needs secret access and filesystem write capability, increasing the risk of over-privileged execution or unsafe invocation in automation contexts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill instructs users to supply an API key and send prompts to Google's external service but gives no privacy notice about data leaving the local environment. In a workflow that may include personal, family, or social-media content, users could unknowingly transmit sensitive prompts or metadata to a third party.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation broadens the skill from content generation into operational Instagram-posting workflow steps, including mode switching and execution of another automation tool. This scope expansion can cause an agent or user to run unrelated posting automation with different trust, privacy, or compliance implications than expected from an image-generation skill.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/generate_instagram_post.py (reported line 104)May include surrounding context.

python
print(f"✅ Image saved: {output_path}")
    
    # Generate caption
    caption_prompt = f"""Write an engaging Instagram caption about: {topic}

Tone: {mood}, authentic, relatable for parents/families
Style: Personal, conversational, NOT promotional

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script accepts a Gemini API key via a command-line argument, which can expose the secret through shell history, process listings, job logs, or terminal recording. In a workflow/agent context, this is especially risky because automation platforms often capture invoked commands and arguments for debugging or auditing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file is predominantly in English, but the 'Stock-Only Mode' section presents key instructions in German. This forces a language change on users without opt-in or justification, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.