Skill X Post Ai Image

• Analyzed: May 11, 2026, 5:00 AM
• Findings: 1
• Version: 1.0.1
• Hash: f522bb014ff9e8b28a1b98fc3fb64d05a33c448c9b72db8f4b50ea789671ef08
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to significant potential vulnerabilities, primarily the Remote Code Execution (RCE) risk in `scripts/post_with_image.py`. The script allows the path to the `nano-banana-pro` skill's script to be overridden by the `NANO_BANANA_SCRIPT` environment variable. If an attacker can control this environment variable (e.g., via prompt injection against the OpenClaw agent), they could execute arbitrary code. Additionally, the script relies on external binaries (`uv`, `xurl`) and passes user-controlled input to them, creating a potential vulnerability chain if these downstream components are not robust against command injection.