nano-banana-image-ad
Fail
Audited by Gen Agent Trust Hub on May 27, 2026
Risk Level: HIGHCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The helper script "scripts/generate_image.py" executes the built-in "sips" command-line utility on macOS to verify the dimensions of generated images.
- [EXTERNAL_DOWNLOADS]: The skill performs network requests to "external-api.arcads.ai" for API communication and uses "urllib" to download resulting images from remote URLs. It also performs file uploads of local reference images to presigned URLs provided by the service.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it interpolates user-provided text into model prompts sent to an external AI service.
- Ingestion points: User-supplied brief in "SKILL.md" Phase 3 and the "--prompt" argument in "scripts/generate_image.py".
- Boundary markers: The skill appends fixed safety suffixes ("NO_CHROME_SUFFIX", "SAFE_ZONE_SUFFIX", "GLYPH_SAFETY_SUFFIX") to the end of the user input to mitigate malicious overrides.
- Capability inventory: The skill uses "subprocess.run" for image metadata checks and "urllib" for external network operations.
- Sanitization: No explicit sanitization or escaping of the user-provided prompt string is performed before interpolation.
- [CREDENTIALS_UNSAFE]: The skill retrieves API credentials from a local ".env" file. This is documented and consistent with standard secret management practices for local agent tools.
Recommendations
- HIGH: Downloads and executes remote code from: unknown (check file) - DO NOT USE without thorough review
Audit Metadata