Security audit

Nano Banana Prompt Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only prompt helper for turning Chinese image requests into structured image-generation JSON, with no code execution, persistence, or credential access.

Installers should expect this skill to respond broadly to image-generation requests and to produce English image prompts with Chinese explanation fields. Review the generated JSON before sending it to an image API, especially for logo text, personal likenesses, or safety settings.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

High

Confidence: 96% confidence
Finding: The skill states that any user description of desired image content should trigger the skill, which creates an overbroad activation boundary. This can cause the skill to hijack ordinary conversations about images and force structured behavior the user did not explicitly request, increasing the risk of unintended prompt generation or workflow interference.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The listed trigger phrases are generic image-related requests that overlap with common user intents such as designing a logo or making a poster. Because they are not uniquely tied to this skill, they may cause accidental activation and undesired instruction takeover in normal assistant interactions.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The skill unconditionally requires prompt.text to be in English, regardless of the user's language preference or consent. While not a direct code-execution issue, this overrides user intent and can lead to misleading transformations, loss of nuance, or unwanted data handling in multilingual contexts.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The output language rule is expressed as an unconditional policy, forcing prompt text to English for all users and requests. In context, this is primarily a user-control and policy-boundary problem: it can silently alter request semantics and reduce transparency, especially for users expecting same-language output.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: This markdown file presents all user-facing examples and headings in Chinese, which imposes a specific language/locale on users. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified, which is not present here.

Static analysis

No suspicious patterns detected.