gemini-image-generation

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:23 PM UTC
• Version: 1.0.10

Overview

The skill mostly does what it claims, but it needs review because it can send prompts, images, and the Gemini API key to a configurable endpoint and its scripts do not enforce workspace-only file paths.

Review before installing. Use only a trusted Gemini endpoint, avoid setting GEMINI_BASE_URL unless you control and trust it, provide a narrowly scoped API key, and only run the scripts on images and output paths you explicitly intend to share or overwrite. Treat source images and prompts as data that will leave the local machine.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/gemini-image-runtime.mjs:122

Finding

Unvalidated Custom Gemini Endpoint Can Receive API Credentials and User Content

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/gemini-image-runtime.mjs:143

Finding

Unrestricted Input and Output Paths Permit Local File Disclosure and Arbitrary File Overwrite

Content

View full analysis

1 && mimeTypes.length !== inputPaths.length) { throw new Error("Pass either one --mime-type for all inputs or one --mime-type per --input"); } return Promise.all( inputPaths.map(async (inputPath, index) => { const imageBuffer = await fs.readFile(inputPath); const mimeType = mimeTypes[index] || mimeTypes[0] || mimeTypeForPath(inputPath); return { mimeType, data: imageBuffer.toString("base64"), }; }), ); } ``` Returned data is written to the requested path without enforcing a workspace root or protecting existing files: ```js export async function saveImageResponse(response, outputPath) { const parts ...[truncated 3803 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Ae2

Medium

• Category: analysis-evasion
• Confidence: 90% confidence

Finding

Artifact content does not match its filename extension

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md

# Image Generation

Use this skill when you need to create one or more image files from a text prompt, or edit one or more existing images with Gemini.

## Requirements

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly instructs users to send prompts and potentially source images to Gemini via an external API, but it does not warn users that their content leaves the local environment for third-party processing. This creates a privacy and data-handling risk, especially if users provide sensitive images or confidential prompt content under the assumption the operation is local.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The code reads local image files, base64-encodes them, and prepares them for submission via the GoogleGenAI client, which results in user-provided file contents being sent over the network. This file does not include a confirmation prompt, user-facing notice, or explanatory comment warning that local image data will be transmitted to a third-party service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The function creates directories and writes returned image data to the filesystem, which is a safety-relevant file write operation. In this file there is no confirmation prompt, user-facing log/print, or explanatory comment/docstring disclosing that generated content will be saved to the specified path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code performs a network call to an external AI service using user-supplied prompt data, but the file itself does not include a confirmation prompt, warning comment, or docstring disclosing that the prompt will be transmitted off-box. The later console output only reports results after the call, so it does not function as a prior user-facing warning about data transmission.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency uses a caret range (^1.44.0), which permits automatic installation of newer compatible versions. This creates a supply-chain risk because a compromised or buggy upstream release could be pulled in without deliberate review, affecting image-generation functionality that likely handles external prompts and API interactions.

Content

Scanner excerpt · package.json (reported line 6)May include surrounding context.

json

"private": true,
  "type": "module",
  "dependencies": {
    "@google/genai": "^1.44.0"
  }
}

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The runtime pulls GEMINI_API_KEY, GEMINI_MODEL_ID, and optionally GEMINI_BASE_URL from process.env to configure the client. While network access to Gemini is expected for this skill, direct environment-variable access is an additional capability not reflected in the manifest description, which only describes generating or editing images in a workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The code accesses GEMINI_API_KEY from the environment to authenticate outbound API calls. Although this is common, it falls under sensitive credential access and this file provides no comment, docstring, or user-facing notice explaining the dependency on environment-stored credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The script saves generated images to the user-specified output location, which is a file write operation. Although the save is part of the apparent purpose of the script, this file contains no prior comment, docstring, or user-facing notice that files will be created or overwritten at the provided path.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.