Nano banana korean rendering

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:00 AM UTC
• Version: 1.0.3

Overview

This skill is a disclosed Gemini-and-Canvas image text rendering helper, with some privacy and supply-chain cautions but no evidence of deception, persistence, or malicious behavior.

Install only if you are comfortable sending prompts, rendered text images, and any --ref images you provide to Google Gemini. Prefer running setup in a minimal environment without unnecessary secrets, and review or pin dependencies and downloaded fonts if reproducibility matters.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: setup.mjs:145

Finding

Unpinned Dependencies and Unverified Remote Font Downloads

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (10)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill metadata and description frame this as a text-preserving rendering utility, but the code also exposes full Gemini-powered image generation through generate/pipeline flows. This hidden expansion of capability broadens data handling, outbound network use, and model-side prompt/media processing beyond what a caller would reasonably expect, which is a real security and trust-boundary issue for agent skills.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill explicitly depends on environment variables and external Gemini API calls, but it does not declare any tool scope or allowed-tools restrictions. This creates a capability/permission mismatch where an agent may invoke network and env access without clear least-privilege boundaries, increasing the chance of unintended secret exposure or unauthorized outbound requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs the agent to send user prompts, rendered text images, and optional reference images to Gemini, but it does not provide a clear privacy notice or external-transfer warning at the point of use. This is risky because users may unknowingly submit sensitive text or images to a third-party service, and the broad triggers make such transmission more likely to happen unexpectedly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The auto-activation triggers are very broad, covering common words like 'text', 'title', and any non-Latin script, so the skill may run for many ordinary image requests without clear user intent. In this skill's context, unintended activation matters because it can cause prompts and possibly images to be routed into an external analysis/generation pipeline, expanding data exposure and unexpected API usage.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The analysis prompt is entirely written in Korean and instructs the LLM to operate in that locale, which can force a specific language behavior regardless of user preference. Under the policy, locale constraints should either be user-selectable or clearly justified as region-specific, neither of which is present here.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The generate/pipeline paths accept arbitrary --ref image paths and upload their contents to Gemini without restricting file origin, purpose, or type beyond a simple extension-based MIME guess. In an agent setting, this can cause unintended exfiltration of local images or sensitive visual data to a third-party API, which exceeds the stated text-preservation function and increases privacy risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The natural-language description is written entirely in Korean and presents the skill as such without indicating any language choice or opt-in. Under the policy for language/locale constraints, this can be a policy concern when a skill appears to assume a specific language without documenting user choice or a justified regional scope.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

Using a caret range for the canvas dependency allows newer package versions to be installed without explicit review, which weakens build reproducibility and can silently introduce vulnerable or malicious upstream changes. In this skill context, canvas is a native/image-processing dependency and has had security advisories before, so drift in resolved versions is more risky than for a purely cosmetic package.

Content

Scanner excerpt · package.json (reported line 12)May include surrounding context.

json

"render": "node render.mjs render"
  },
  "dependencies": {
    "canvas": "^3.1.0",
    "@google/generative-ai": "^0.21.0"
  }
}

Unverifiable Dependency: canvas has 2 known advisory(ies) (CVE-2020-8215 (Buffer overflow in canvas); GHSA-vpq5-4rc8-c222 (Denial of Service in canvas)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 86% confidence

Finding

The manifest references canvas with a non-exact version while known advisories exist for that package, making it impossible to verify from this file alone whether the installed version is safe. In an image-rendering skill that processes text and graphics, a vulnerable native parsing/rendering library can increase exposure to crashes, denial of service, or memory-safety issues depending on the deployed version.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

Using a caret range for @google/generative-ai permits automatic adoption of future releases, reducing supply-chain control and reproducibility. Because this library handles AI-service interactions and potentially sensitive prompts or generated content, unexpected upstream changes could affect security posture, data handling, or integrity of outputs.

Content

Scanner excerpt · package.json (reported line 13)May include surrounding context.

json

},
  "dependencies": {
    "canvas": "^3.1.0",
    "@google/generative-ai": "^0.21.0"
  }
}

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: setup.mjs:81

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: setup.mjs:216