ClawHub
Back to skill

Security audit

Nano Banana 2 FAL

Security checks across malware telemetry and agentic risk

Overview

This appears to be a normal image-generation skill that uses Google Gemini, with a privacy note because prompts and uploaded images leave the local machine.

Install only if you are comfortable with your image prompts and any uploaded/reference images being sent to Google Gemini. Avoid using private documents, faces, credentials, or sensitive photos unless you trust that provider's handling of the data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script sends the user's prompt and any uploaded images to Google's external Gemini API, but it does not provide an explicit user-facing warning at the point of transmission. This creates a real privacy and data-handling risk because users may unknowingly upload sensitive images or text to a third-party service, especially in an agent/skill context where execution can feel local or implicit.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.