Trust Assessment
nano-banana-pro received a trust score of 72/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 0 critical, 2 high, 0 medium, and 0 low severity. Key findings include Arbitrary file read via --input-image argument, Arbitrary file write via --filename argument.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Arbitrary file read via --input-image argument The `generate_image.py` script directly uses the value of the `--input-image` argument in `PILImage.open()` without proper path validation. This allows an attacker to specify arbitrary file paths (e.g., `/etc/passwd`, `~/.ssh/id_rsa`), potentially leading to the reading of sensitive files. While the file content is not directly exfiltrated, its existence can be confirmed, and error messages from `PILImage.open()` might leak information about the file or its contents if it's not a valid image format. Implement strict validation for the `--input-image` path. Ensure the path is relative to an allowed directory (e.g., the current working directory) and does not contain path traversal sequences (`..`). Alternatively, restrict input image paths to a designated, isolated directory or use a file picker mechanism. | LLM | scripts/generate_image.py:100 | |
| HIGH | Arbitrary file write via --filename argument The `generate_image.py` script uses the `--filename` argument directly to construct the output path (`output_path = Path(args.filename)`). This allows an attacker to specify paths with directory traversal sequences (e.g., `../../sensitive_file.png`) or absolute paths (e.g., `/tmp/malicious.png`), leading to the creation or overwriting of files in arbitrary locations on the filesystem where the skill has write permissions. Sanitize the `--filename` argument to prevent path traversal. Ensure that the output file is always saved within a designated, safe directory (e.g., the current working directory) and that only the base filename is used, stripping any directory components from user input. For example, `output_path = Path(os.getcwd()) / Path(args.filename).name`. | LLM | scripts/generate_image.py:86 |
Scan History
Embed Code
[](https://skillshield.io/report/54cc209723e367a0)
Powered by SkillShield