nano-banana-image-combine
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The _build_combination_prompt method in ImageCombinationService (SKILL.md) directly interpolates the user-provided user_prompt into the system-level instructions. An attacker can provide a prompt designed to override the agent's constraints or extract sensitive system information.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple sources (image URLs and text prompts) without using boundary markers or sanitization. This exposes the underlying multimodal model (Gemini 2.5 Flash) to instructions embedded in images or external text data.
- Ingestion points: CombineImagesInput.image_urls and CombineImagesInput.prompt in SKILL.md.
- Boundary markers: Absent; inputs are concatenated into a single string.
- Capability inventory: Network GET requests via httpx, network POST requests to OpenRouter, and image processing via Pillow.
- Sanitization: Absent.
- [DATA_EXFILTRATION]: The ImageEncoder.download_image function in SKILL.md performs a network fetch on any URL provided in the image_urls list. Without domain whitelisting or IP validation, this is vulnerable to Server-Side Request Forgery (SSRF), potentially allowing an attacker to exfiltrate data from internal services or probe the local network environment.
Audit Metadata