Nano banana korean rendering

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:06 AM UTC
• Version: 1.0.3

Overview

This skill coherently renders non-Latin text for AI images using Canvas and Gemini, with external API and dependency-install risks that are disclosed enough to treat as cautions rather than review blockers.

Install only if you are comfortable running npm install, downloading font files, and sending prompts plus selected rendered/reference images to Google's Gemini service. Use a limited Gemini API key and avoid sensitive text or private images unless you intend to upload them for generation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The skill metadata frames this as a text-preserving renderer, but the file also implements full prompt-driven Gemini image generation and a pipeline that uploads prompts, rendered text images, and optional references to an external model. This is a scope-expansion/data-flow mismatch that can mislead integrators and users about what the skill actually does, increasing the chance that sensitive prompts or files are transmitted off-box unexpectedly.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The generate/pipeline flows accept arbitrary --ref file paths and upload their contents to Gemini, even though the stated purpose is text rendering. That broad file-ingestion capability can be abused to exfiltrate unintended local images or other user-supplied data to a third party, especially if callers assume the skill only performs local rendering.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly documents sending user prompts, rendered text, and optional reference images to Gemini, but it does not warn users that their content leaves the local environment and is transmitted to a third-party service. This creates a real privacy and consent issue because users may include sensitive text, personal images, or proprietary material without realizing it will be externally processed.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The activation triggers are broad enough to match common benign requests containing words like 'text', 'logo', 'title', or 'headline', causing the skill to run automatically in many cases. In this skill, automatic activation is more dangerous because execution can lead to prompt and image data being sent to Gemini, expanding privacy exposure and potentially overriding more appropriate workflows.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"render": "node render.mjs render"
  },
  "dependencies": {
    "canvas": "^3.1.0",
    "@google/generative-ai": "^0.21.0"
  }
}

• Confidence: 86% confidence
• Finding: "canvas": "^3.1.0"

Unpinned Dependencies

Low

• Category: Supply Chain

Content

},
  "dependencies": {
    "canvas": "^3.1.0",
    "@google/generative-ai": "^0.21.0"
  }
}

• Confidence: 89% confidence
• Finding: "@google/generative-ai": "^0.21.0"

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: setup.mjs:81

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: setup.mjs:216