banner-creator
Warn
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION] (MEDIUM): The
SKILL.mdworkflow instructs the agent to execute shell commands (Step 2 and Step 5) using variables derived from user input ({style},{brand},{description}, etc.). If the agent performs literal string interpolation without sanitization, an attacker could provide input containing shell metacharacters (e.g.,;,&,|) to execute arbitrary commands on the underlying system.\n - Evidence:
python3 <nanobanana_skill_dir>/scripts/batch_generate.py "{style} banner for {brand}, {description}, {text elements}"inSKILL.md.\n- [EXTERNAL_DOWNLOADS] (MEDIUM): The skill has a hard dependency on thenanobananaskill for core image generation. Because this dependency is a local path reference to an external skill not included in this audit, its safety and behavior are unverifiable.\n - Evidence:
Required Skills: nanobananaand repeated references to<nanobanana_skill_dir>inSKILL.md.\n- [PROMPT_INJECTION] (LOW): Indirect Prompt Injection vulnerability surface.\n - Ingestion points:
SKILL.mdStep 1 (Purpose, Target ratio, Style preference, Content elements, Color preferences).\n - Boundary markers: None. The instructions do not use delimiters or specify that the agent should ignore instructions embedded in user-provided style descriptions.\n
- Capability inventory: File system access (
.skill-archive), subprocess execution viapython3, and network operations (implied via thenanobananaAPI calls).\n - Sanitization: No sanitization or validation logic is defined for user input before it is interpolated into generation prompts.
Audit Metadata