Nano Banana Pro

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:13 AM UTC
• Version: 1.0.5

Overview

This image-generation skill is mostly purpose-aligned, but it should be reviewed because it encourages unsafe API-key handling and under-explains external upload of prompts and images.

Review before installing. Prefer setting GEMINI_API_KEY through a protected environment or secret manager rather than passing it in chat or as --api-key, avoid sensitive prompts or private images unless you are comfortable sending them to Google’s Gemini service, and consider pinning dependencies or running the script in a restricted environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/generate_image.py:2

Finding

Runtime Dependencies Are Not Pinned to Reviewed Versions

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_image.py:2-7
Vulnerability Type: Supply-chain exposure through mutable dependency resolution
Risk Level: Medium

Vulnerable Code

python

# /// script
# requires-python = ">=3.10"
# dependencies = [
#     "google-genai>=1.0.0",
#     "pillow>=10.0.0",
# ]
# ///

Technical Analysis

The inline dependency metadata specifies only minimum versions for google-genai and pillow. There is no upper bound, exact version pin, integrity hash, or committed lockfile represented in the audited project.

When the documented uv run workflow resolves these requirements, it may install a future release that was not present during this audit. Python packages can execute code during installation or when imported. The script imports both dependencies in the same process that holds the Gemini API key and processes user prompts and images:

python

from google import genai
from google.genai import types
from PIL import Image as PILImage

Therefore, compromise of a dependency publisher account, package repository, release process, or a future compatible release could change the effective code executed by this Skill without any modification to the audited repository.

Attack Path

1. An attacker compromises the publication channel for a declared dependency or causes a malicious release satisfying the open-ended version constraint to be published.
2. A user invokes the documented uv run command in an environment that has not locked the previously reviewed dependency versions.
3. uv resolves and installs the newer satisfying release.
4. Malicious package code executes during installation or import.
5. That code runs with the invoking user's privileges and can access the process environment, including GEMINI_API_KEY, as well as prompts, input images, and files accessible to the user.

Impact Assessment

Successful ...[truncated 384 chars]

Remediation

View remediation

Remediation Suggestions

• Pin each dependency to an exact, reviewed version rather than using minimum-version constraints.
• Generate and commit a uv lockfile containing fully resolved transitive dependencies.
• Enforce package integrity verification with hashes where the selected packaging workflow supports it.
• Install only from a trusted, explicitly configured package index.
• Review dependency changes before regenerating the lockfile, and automate vulnerability and provenance checks in CI.
• Run image generation in a restricted environment with only the required filesystem and network access.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_image.py:49

Finding

Gemini API Key Can Be Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_image.py:49-52
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: Medium

Vulnerable Code

python

parser.add_argument(
    "--api-key", "-k",
    help="Gemini API key (overrides GEMINI_API_KEY env var)"
)

The accompanying instructions explicitly advertise this interface in commands such as:

bash

uv run ~/.codex/skills/nano-banana-pro/scripts/generate_image.py --prompt "your image description" --filename "output-name.png" [--resolution 1K|2K|4K] [--api-key KEY]

Technical Analysis

Secrets supplied as command-line arguments can be exposed outside the intended process. Depending on the host and execution environment, command arguments may be recorded in shell history, process-monitoring output, terminal transcripts, CI logs, audit records, or orchestration metadata.

The code gives the command-line value precedence over the environment variable:

python

def get_api_key(provided_key: str | None) -> str | None:
    """Get API key from argument first, then environment."""
    if provided_key:
        return provided_key
    return os.environ.get("GEMINI_API_KEY")

Although the key is legitimately used to initialize the Google client and is not explicitly transmitted to unrelated services by the audited script, accepting and documenting plaintext command-line credentials unnecessarily broadens the key's exposure surface.

Attack Path

1. A user follows the documented usage and supplies the Gemini API key with --api-key or -k.
2. The complete command is retained in shell history, captured in execution logs, or temporarily exposed through local process inspection.
3. Another local user, administrator, monitoring service, or person with access to those records retrieves the key.
4. The recovered credential is used independently against Gemini services until it is r ...[truncated 417 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the --api-key and -k options, or clearly deprecate them and reject their use by default.
• Prefer a protected environment variable or an operating-system/cloud secret manager.
• If interactive entry is required, read the key with a non-echoing prompt through getpass, rather than placing it in process arguments.
• Update SKILL.md to remove command examples that encourage plaintext command-line credentials.
• Ensure CI and automation inject the secret through protected secret facilities and mask it in logs.
• Rotate any credential that may previously have appeared in shell history, process records, or build logs.
• Apply least-privilege API restrictions, quota limits, and usage monitoring to Gemini credentials.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (6)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

md

- Prompt "A serene Japanese garden" → `2025-11-23-14-23-05-japanese-garden.png`
- Prompt "sunset over mountains" → `2025-11-23-15-30-12-sunset-mountains.png`
- Prompt "create an image of a robot" → `2025-11-23-16-45-33-robot.png`
- Unclear context → `2025-11-23-17-12-48-x9k2.png`

## Image Editing

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_image.py (reported line 23)May include surrounding context.

python

def get_api_key(provided_key: str | None) -> str | None:
    """Get API key from argument first, then environment."""
    if provided_key:
        return provided_key
    return os.environ.get("GEMINI_API_KEY")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill instructs users to run a local script that consumes environment secrets (GEMINI_API_KEY) and can accept file paths, but the manifest declares no explicit tool scope or permissions. This weakens reviewability and can cause the runtime to grant broader capabilities than readers expect, increasing the chance of accidental secret or filesystem exposure when the skill is used.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill repeatedly suggests passing the API key via --api-key, which can expose secrets through shell history, process listings, logs, and terminal transcripts. For a credential used to call a paid external API, this is a real operational security risk and can lead to unauthorized API use or billing abuse.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md

Examples:
- Prompt "A serene Japanese garden" → `2025-11-23-14-23-05-japanese-garden.png`
- Prompt "sunset over mountains" → `2025-11-23-15-30-12-sunset-mountains.png`
- Prompt "create an image of a robot" → `2025-11-23-16-45-33-robot.png`
- Unclear context → `2025-11-23-17-12-48-x9k2.png`

## Image Editing

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script sends user prompts and optional input images to Google's remote Gemini API, but the usage/help text and module documentation do not clearly warn that supplied content leaves the local machine. This is a genuine privacy/transparency issue because users may provide sensitive images or prompts without realizing they are transmitted to a third party.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.