nano-banana-pro

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The prompt explicitly allows passing the API key as a command-line flag (--api-key <KEY>), which would require embedding the secret verbatim in generated commands/outputs and creates an exfiltration risk (though setting GEMINI_API_KEY as an env var is safe).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow sends OUTSIDER-authored free text into the LLM via contents = [*input_images, args.prompt] where args.prompt is user-supplied prompt text (not chosen/curated by the agent), and the script passes it to client.models.generate_content(...) as contents (prompt injection risk from arbitrary free-form text).