Nano Banana 2 Image Generation&Editing

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 10:51 AM UTC
• Version: 1.0.9

Overview

This skill is a disclosed image-generation and image-editing helper that sends prompts or images to Atlas Cloud or Google APIs as expected for its purpose.

Install only if you are comfortable sending image prompts and any selected images to Atlas Cloud or Google AI Studio using your own API key. Avoid using confidential, regulated, or highly personal images unless you explicitly intend to upload them to those services.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The trigger description is extremely broad, matching generic requests like creating thumbnails, banners, logos, product photos, or any visual asset. Over-broad routing can cause this skill to activate in contexts the user did not intend, leading to unnecessary third-party transmission of prompts or images and increasing the chance of accidental file upload or API-key-backed actions.

Credential Access

High

• Category: Privilege Escalation

Content

3. If both are set → ask the user which provider to use
4. If neither is set → ask the user to configure one:
   - **Atlas Cloud**: Sign up at https://www.atlascloud.ai, Console → API Keys → Create key, then `export ATLASCLOUD_API_KEY="your-key"`
   - **Google AI Studio**: Get key from https://aistudio.google.com/apikey, then `export GEMINI_API_KEY="your-key"`

**Atlas Cloud**
- Async API with polling workflow

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

## Mode 2: Google AI Studio (Official)

### Setup
1. Get API key from https://aistudio.google.com/apikey
2. Set environment variable: `export GEMINI_API_KEY="your-key"`

### Text-to-Image Generation

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill requires environment access and performs network operations, but it does not declare an explicit tool scope such as allowed tools or permissions. This weakens isolation and reviewability because an agent may invoke networked behavior without a narrowly declared boundary, increasing the chance of unintended API use or data egress.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Step 1: Submit generation request
curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateImage" \
  -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 90% confidence
• Finding: This instruction sends user prompts to Atlas Cloud over the network, which is an external data transfer. In this skill context that is expected functionality, but it is still security-relevant because user content and API-authenticated requests leave the local environment and are handled by a third party.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Step 1: Submit generation request
curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateImage" \
  -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 90% confidence
• Finding: This instruction sends user prompts to Atlas Cloud over the network, which is an external data transfer. In this skill context that is expected functionality, but it is still security-relevant because user content and API-authenticated requests leave the local environment and are handled by a third party.

External Transmission

Medium

• Category: Data Exfiltration

Content

To use local images for editing, first upload them to get a URL. The agent MUST confirm with the user before uploading any local file (e.g., "I'll upload `/path/to/image.jpg` to Atlas Cloud for editing. Proceed?").

```bash
curl -s -X POST "https://api.atlascloud.ai/api/v1/model/uploadMedia" \
  -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \
  -F "file=@/path/to/local/image.jpg"
# Returns: { "code": 200, "data": { "download_url": "https://...url...", "filename": "image.jpg", "size": 123456 } }

• Confidence: 97% confidence
• Finding: This step uploads a local file to Atlas Cloud, creating a direct exfiltration path for local image data. Although the skill explicitly says the agent must ask for confirmation first, the capability is inherently sensitive because a mistaken or overly eager invocation could disclose local files to a third party.

External Transmission

Medium

• Category: Data Exfiltration

Content

| `resolution` | string | No | 1k | 1k, 2k, 4k |

```bash
curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateImage" \
  -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 90% confidence
• Finding: The editing workflow submits prompts and referenced image URLs to Atlas Cloud, which creates an external data exposure point. In context this is part of the skill's purpose, but if source images contain sensitive content, the skill enables transmission to a third party and should therefore be treated as a real data-egress risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

| `resolution` | string | No | 1k | 1k, 2k, 4k |

```bash
curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateImage" \
  -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 90% confidence
• Finding: The editing workflow submits prompts and referenced image URLs to Atlas Cloud, which creates an external data exposure point. In context this is part of the skill's purpose, but if source images contain sensitive content, the skill enables transmission to a third party and should therefore be treated as a real data-egress risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

Include the source image as base64 inline_data alongside the text prompt:

```bash
curl -s -X POST \
  "https://generativelanguage.googleapis.com/v1beta/models/gemini-3.1-flash-image-preview:generateContent" \
  -H "x-goog-api-key: $GEMINI_API_KEY" \
  -H "Content-Type: application/json" \

• Confidence: 89% confidence
• Finding: The Google AI Studio editing flow transmits prompts and base64-encoded image content to Google's API, making this a clear external transmission path. Because inline image data may contain sensitive local content, the risk is higher than a purely text-based request even though the behavior is documented.

External Transmission

Medium

• Category: Data Exfiltration

Content

import urllib.error
import urllib.parse

API_BASE = "https://api.atlascloud.ai/api/v1"
GEMINI_API_BASE = "https://generativelanguage.googleapis.com/v1beta"
GEMINI_MODEL = "gemini-3.1-flash-image-preview"
UA = "AtlasCloud-Skill/1.0"

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

import urllib.error
import urllib.parse

API_BASE = "https://api.atlascloud.ai/api/v1"
GEMINI_API_BASE = "https://generativelanguage.googleapis.com/v1beta"
GEMINI_MODEL = "gemini-3.1-flash-image-preview"
UA = "AtlasCloud-Skill/1.0"

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.