NBP

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:54 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward image generator/editor that uses Google's Gemini image API, with some privacy and credential-handling cautions but no evidence of hidden or malicious behavior.

Install only if you are comfortable sending prompts and any input images to Google's Gemini image service. Prefer setting GEMINI_API_KEY in a protected environment instead of pasting keys into chat or command arguments, and be aware that uv may fetch current dependency versions when the script runs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/generate_image.py:2

Finding

Unpinned Runtime Dependencies Create a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_image.py, lines 2-7
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code:

python

# /// script
# requires-python = ">=3.10"
# dependencies = [
#     "google-genai>=1.0.0",
#     "pillow>=10.0.0",
# ]
# ///

Technical Analysis

The inline dependency declaration specifies only minimum versions for google-genai and pillow, with no upper bounds, exact version pins, integrity hashes, or committed lockfile. Consequently, the documented uv run workflow may resolve and install a newer package version that was not reviewed with this skill.

This is a supply-chain weakness rather than evidence that the currently named packages are malicious. If a permitted future release or its distribution channel is compromised, package-controlled code may execute when Python imports the dependency. In this script, imports occur after the API key is loaded into the process:

python

api_key = get_api_key(args.api_key)

from google import genai
from google.genai import types
from PIL import Image as PILImage

A malicious dependency would therefore execute in a process that may contain the Gemini API key, the user's prompt, a local input-image path, and access rights inherited from the invoking user.

Attack Path

1. An attacker compromises a future release of one of the permitted packages or its package-distribution account.
2. The malicious release retains a version satisfying google-genai>=1.0.0 or pillow>=10.0.0.
3. A user invokes the skill through the documented uv run command in an environment where that version is resolved.
4. uv downloads and installs the unreviewed release.
5. The script imports the compromised package.
6. Package initialization code executes with the permissions of the user running the skill.
7. The malicious code may access process secrets and files available to t ...[truncated 473 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to an exact, reviewed version rather than using minimum-version ranges.
2. Generate and commit a uv lockfile so deployments resolve the same transitive dependency graph.
3. Enforce package integrity verification with trusted hashes where the deployment workflow supports it.
4. Update dependencies only through a controlled process that includes security review, vulnerability scanning, and testing.
5. Use a trusted package index and prevent fallback to untrusted or user-controlled indexes.
6. Execute the image-generation process with minimal filesystem and environment access to reduce the impact of a future dependency compromise.
7. Avoid exposing the API key to the process before imports unless it is operationally necessary.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/generate_image.py:47

Finding

Gemini API Key Can Be Exposed Through Command-Line Arguments and Chat History

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_image.py, lines 47-50; SKILL.md, lines 11-17 and 52-55
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Low

Vulnerable Code:

python

parser.add_argument(
    "--api-key", "-k",
    help="Gemini API key (overrides GEMINI_API_KEY env var)"
)

Related documented usage:

bash

uv run ~/.codex/skills/nano-banana-pro/scripts/generate_image.py --prompt "your image description" --filename "output-name.png" [--resolution 1K|2K|4K] [--api-key KEY]

bash

uv run ~/.codex/skills/nano-banana-pro/scripts/generate_image.py --prompt "editing instructions" --filename "output-name.png" --input-image "path/to/input.png" [--resolution 1K|2K|4K] [--api-key KEY]

Related key-handling instructions:

markdown

## API Key

The script checks for API key in this order:
1. `--api-key` argument (use if user provided key in chat)
2. `GEMINI_API_KEY` environment variable

If neither is available, the script exits with an error message.

Technical Analysis

The skill accepts a long-lived API credential directly as a command-line argument and explicitly recommends using that mechanism when a user provides a key in chat. Command-line secrets can be retained in shell history, terminal logs, command telemetry, or process-launch audit records. Depending on operating-system configuration, process arguments may also be observable by other local users or monitoring agents while the command is running.

Supplying the key through chat creates an additional copy in conversation history and any associated service logs. Although the script does not print the key itself, avoiding direct output does not protect copies already present in command arguments or chat records.

Attack Path

1. A user supplies a Gemini API key in chat or invokes the script with --api-key KEY.
2. The complete command may be recorded in ...[truncated 902 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the --api-key option or clearly deprecate it and reject command-line secrets by default.
2. Do not request, accept, or recommend transmitting API keys through chat.
3. Prefer secret injection through a protected environment configured outside shell history, an operating-system keychain, or a permission-restricted credential file.
4. If interactive entry is required, read the key from a non-echoing prompt or standard input rather than from command-line arguments.
5. Ensure logs and error messages never include credential values.
6. Document credential rotation procedures for users who previously supplied keys through chat or command-line history.
7. Apply the least privilege available to the API key, including quota restrictions, API restrictions, and routine rotation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (5)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md

- Prompt "A serene Japanese garden" → `2025-11-23-14-23-05-japanese-garden.png`
- Prompt "sunset over mountains" → `2025-11-23-15-30-12-sunset-mountains.png`
- Prompt "create an image of a robot" → `2025-11-23-16-45-33-robot.png`
- Unclear context → `2025-11-23-17-12-48-x9k2.png`

## Image Editing

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_image.py (reported line 23)May include surrounding context.

python

def get_api_key(provided_key: str | None) -> str | None:
    """Get API key from argument first, then environment."""
    if provided_key:
        return provided_key
    return os.environ.get("GEMINI_API_KEY")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill invokes a script that relies on environment access for GEMINI_API_KEY, but the manifest does not declare any tool scope or permissions boundary. This weakens least-privilege enforcement and can allow broader-than-expected environment access when the skill runs, increasing the chance of accidental secret exposure or unauthorized capability use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill tells users to send prompts and optionally local images to Google's external API but does not clearly warn that this data leaves the local environment. Users may unknowingly transmit sensitive text or private images to a third party, creating privacy, compliance, and data-handling risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md

Examples:
- Prompt "A serene Japanese garden" → `2025-11-23-14-23-05-japanese-garden.png`
- Prompt "sunset over mountains" → `2025-11-23-15-30-12-sunset-mountains.png`
- Prompt "create an image of a robot" → `2025-11-23-16-45-33-robot.png`
- Unclear context → `2025-11-23-17-12-48-x9k2.png`

## Image Editing

Static analysis

No suspicious patterns detected.