Skill X Post Ai Image

• Outcome: Review
• Latest audit: May 28, 2026 · 11:35 AM UTC
• Version: 1.0.1

Overview

The skill appears to do what it advertises, but it can publish live X/Twitter posts and runs an overridable helper script with broad environment access to credentials.

Install only if you are comfortable granting runtime access to X/Twitter OAuth tokens and a Gemini API key. Use a test or dedicated account where possible, review text and image prompts before running, avoid setting NANO_BANANA_SCRIPT to any untrusted path, and prefer isolating credentials so the image helper cannot see X posting tokens.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

)

def generate_image(prompt: str, out_path: str) -> str:
    result = subprocess.run(
        ["uv", "run", NANO_BANANA_SCRIPT, "--prompt", prompt, "--filename", out_path, "--resolution", "1K"],
        capture_output=True, text=True,
        env={**os.environ, "GEMINI_API_KEY": os.environ.get("GEMINI_API_KEY", "")}

• Confidence: 95% confidence
• Finding: The script invokes an external program via subprocess to generate the image, and the executable script path is configurable through the NANO_BANANA_SCRIPT environment variable. Although shell injection is avoided by using an argument list, this still enables execution of arbitrary code if that environment variable or the referenced script is tampered with, which is especially dangerous because sensitive environment variables are also passed into the child process.

Direct flow: os.environ.get (credential/environment) → subprocess.run (code execution)

High

• Category: Data Flow

Content

)

def generate_image(prompt: str, out_path: str) -> str:
    result = subprocess.run(
        ["uv", "run", NANO_BANANA_SCRIPT, "--prompt", prompt, "--filename", out_path, "--resolution", "1K"],
        capture_output=True, text=True,
        env={**os.environ, "GEMINI_API_KEY": os.environ.get("GEMINI_API_KEY", "")}

• Confidence: 98% confidence
• Finding: The child process receives a near-complete copy of os.environ, including credentials and other sensitive values, and then executes code from an external script. If that script is replaced, compromised, or user-controlled through configuration, it can directly read and exfiltrate secrets such as X and Gemini credentials.

Tainted flow: 'NANO_BANANA_SCRIPT' from os.environ.get (line 14, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

)

def generate_image(prompt: str, out_path: str) -> str:
    result = subprocess.run(
        ["uv", "run", NANO_BANANA_SCRIPT, "--prompt", prompt, "--filename", out_path, "--resolution", "1K"],
        capture_output=True, text=True,
        env={**os.environ, "GEMINI_API_KEY": os.environ.get("GEMINI_API_KEY", "")}

• Confidence: 98% confidence
• Finding: NANO_BANANA_SCRIPT is read from the environment and then executed, creating a direct path from attacker-influenced configuration to code execution. In the context of a skill that also loads API secrets, this significantly raises the risk of arbitrary code execution and credential theft.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documentation indicates use of environment variables holding sensitive API and OAuth tokens and execution of shell-capable tooling (`python3`, `uv`, `xurl`), but it does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: an agent or user may invoke the skill without realizing it can access secrets and perform authenticated external actions such as posting to X/Twitter.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill’s stated purpose is to generate an image and post to X, but it achieves this by executing an external script from a configurable path. That expands the capability beyond the minimum necessary and creates an unnecessary execution boundary where arbitrary or swapped code could run.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README explicitly advertises generating AI images and posting them to X/Twitter, but it provides no warning that the action publishes content to an external public platform. That omission can mislead users or downstream agents into triggering unintended public posting, which is especially risky because the workflow combines content generation and publication in a single step.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The script posts to X immediately once invoked, without any confirmation step, dry-run mode, or explicit warning before the irreversible network action. In an agent setting, this increases the chance of unintended public posting, reputational harm, or abuse if upstream inputs are manipulated.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.