Trust Assessment
nano-banana-pro-openrouter received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Sensitive environment variable access: $HOME, Skill loads API keys and base URL from untrusted .env in current working directory.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Skill loads API keys and base URL from untrusted .env in current working directory The `generate_image.sh` script explicitly loads environment variables from `$PWD/.env` using `load_env_file "$PWD/.env"`. If an attacker can control the current working directory where the skill is executed, they can place a malicious `.env` file. This file could define `OPENROUTER_API_KEY` and `OPENROUTER_BASE_URL` to point to an attacker-controlled server. The script would then use these attacker-controlled values, sending the user's prompt and the (potentially legitimate) API key to the attacker's endpoint, leading to data exfiltration and credential harvesting. This bypasses the agent's control over environment variables and configuration, and contradicts the `SKILL.md`'s statement that 'OpenClaw does NOT auto-source the skill .env file'. Remove `load_env_file "$PWD/.env"` from the script. The skill should rely solely on environment variables explicitly passed by the agent or command-line arguments. If `.env` files are deemed necessary for skill-specific configuration, they should only be loaded from a trusted, immutable skill directory (e.g., `$skill_dir/.env`), and the agent should ideally be responsible for providing configuration rather than the skill implicitly loading it. | LLM | scripts/generate_image.sh:127 | |
| MEDIUM | Sensitive environment variable access: $HOME Access to sensitive environment variable '$HOME' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/duffycoder/nano-banana-pro-openrouter/scripts/generate_image.sh:171 |
Scan History
Embed Code
[](https://skillshield.io/report/9cb8db6c7015b082)
Powered by SkillShield