Nano Banana 2 FAL

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 3:20 PM UTC
• Version: 1.0.0

Overview

This skill coherently provides Gemini-based image generation/editing with expected API-key, network, input-image, and output-file handling, with some install and credential-handling cautions.

Install only if you are comfortable sending prompts and any selected input images to Google's Gemini API. Prefer GEMINI_API_KEY or a protected OpenClaw config over passing keys on the command line, and consider pinning or locking uv dependencies if you need reproducible installs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/generate_image.py:2

Finding

Unpinned Runtime Dependencies Permit Supply-Chain Drift

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_image.py:2-7
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code:

python

# /// script
# requires-python = ">=3.10"
# dependencies = [
#     "google-genai>=1.0.0",
#     "pillow>=10.0.0",
# ]
# ///

Technical Analysis

The script declares open-ended minimum versions for google-genai and pillow. The documented execution method uses uv run, which may resolve and install any future package release satisfying these constraints. The project does not include an audited lockfile, exact version constraints, or package integrity hashes.

Consequently, the dependency code executed at runtime may differ from the code originally reviewed. Imports can execute package initialization code, while source distributions may also execute build-backend code during installation. This creates exposure to compromised upstream releases, maintainer-account compromise, and future dependency vulnerabilities.

Attack Path

1. An attacker compromises an upstream dependency, its publishing account, or a future release satisfying the declared minimum version.
2. The attacker publishes a malicious or compromised package version.
3. A user executes the documented uv run command in an environment without a previously locked dependency resolution.
4. uv resolves and installs the compromised version because it satisfies the open-ended constraint.
5. Malicious code executes during package build, installation, or import with the privileges of the user running the Skill.

Impact Assessment

Successful exploitation could provide code execution under the Agent user's account. Depending on that account's permissions, malicious dependency code could read accessible files and environment variables—including GEMINI_API_KEY—modify user-owned data, or make unauthorized network requests. This issue does not directly provid ...[truncated 71 chars]

Remediation

View remediation

Remediation Suggestions

• Pin dependencies to exact, reviewed versions instead of open-ended minimum versions.
• Generate and commit a uv.lock file containing the complete resolved dependency graph.
• Run the script in locked or frozen mode so execution fails rather than silently changing dependency versions.
• Use integrity verification or trusted package mirrors in deployment workflows.
• Enable automated dependency vulnerability monitoring and review upgrades before updating the lockfile.
• Execute the Skill under a least-privileged account or sandbox with restricted filesystem and network access.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/generate_image.py:53

Finding

Gemini API Key Can Be Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_image.py:53-65
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: Low

Vulnerable Code:

python

parser.add_argument(
    "--api-key", "-k",
    help="Gemini API key (overrides GEMINI_API_KEY env var)"
)

args = parser.parse_args()

# Get API key
api_key = get_api_key(args.api_key)

Technical Analysis

The script allows a Gemini API key to be supplied directly through --api-key or -k. Command-line arguments are not an appropriate secret-transport mechanism because they may be retained in shell history, captured by command-execution telemetry, included in diagnostic logs, or exposed through process inspection facilities to authorized local observers.

The script does not print the key itself, and the environment-variable option is available. The risk arises when users choose the explicitly supported command-line option.

Attack Path

1. A user starts the script with --api-key SECRET or -k SECRET.
2. The full command is stored in shell history, captured by an orchestration or monitoring system, or temporarily exposed in the process argument list.
3. A local user, administrator, support operator, or party with access to those records retrieves the argument.
4. The party uses the recovered key to authenticate to the Gemini API until the key is revoked or expires.

Impact Assessment

Exposure could allow unauthorized consumption of the associated API quota and use of Gemini API capabilities authorized by the key. It could also cause billing impact and make malicious requests appear attributable to the legitimate key owner. The accessible scope is limited to permissions granted to that API key; this finding does not itself grant operating-system privilege escalation.

Remediation

View remediation

Remediation Suggestions

• Remove the --api-key and -k command-line options.
• Continue supporting GEMINI_API_KEY, while ensuring launch environments and diagnostic tooling do not disclose environment variables.
• Prefer an operating-system secret store, protected configuration file, or secret-manager integration for managed deployments.
• If interactive credential entry is required, read the key using a non-echoing prompt rather than a command-line argument.
• Document key rotation and revocation procedures.
• Advise existing users who supplied keys on the command line to clear relevant shell history and rotate potentially exposed keys.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_image.py (reported line 26)May include surrounding context.

python

def get_api_key(provided_key: str | None) -> str | None:
    """Get API key from argument first, then environment."""
    if provided_key:
        return provided_key
    return os.environ.get("GEMINI_API_KEY")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.