nano-banana-pro
Fail
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: HIGHPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [Indirect Prompt Injection] (HIGH): The skill ingests untrusted text prompts that are processed by an external LLM. The agent is then instructed to use shell commands to download files using metadata provided by the API response. \n * Ingestion points: The
promptfield in the input JSON (SKILL.md).\n * Boundary markers: None present to distinguish instructions from data.\n * Capability inventory: The skill usesrefly file downloadto write to the filesystem andopento interact with downloaded files (SKILL.md, Step 3).\n * Sanitization: The shell scriptOUTPUT_PATH="$HOME/Desktop/${FILE_NAME}"uses theFILE_NAMEvariable directly from the API without sanitization, allowing for path traversal (e.g.,../../.bashrc) or execution of arbitrary files if the filename extension is malicious (e.g.,.command).\n- [COMMAND_EXECUTION] (LOW): The skill documentation provides specific shell command sequences for the agent to execute, which interact with the local environment and the Refly platform CLI.
Recommendations
- AI detected serious security threats
Audit Metadata