[Security] nano-banana-pro follows output symlinks and overwrites files outside the working directory

まず skills/nano-banana-pro/scripts/generate_image.py に着手し、ここで --filename 引数が画像の書き込み前に出力パスへと変換される。解決済みの出力先（os.path.realpath）を作業ディレクトリと比較し、ターゲットがシンボリックリンクの場合、または作業ディレクトリ外へ逸脱する場合はスキップまたは拒否する。この Issue で示された修正案では、既存の出力先に対する明示的な上書きフラグにも言及している。再現手順で検証する：一時ワークスペースにシンボリックリンクを作成し、スクリプトを実行し、ワークスペース外のセンチファイルが変更されていないことを確認する。完了の条件は、シンボリックリンクのケースが明確なエラーで拒否され、通常の出力ファイル名が引き続き機能することである。

Hi, I found a symlink-following issue in the nano-banana-pro skill that can overwrite files outside the working directory.
GitHub: https://github.com/steipete/agent-scripts/tree/main/skills/nano-banana-pro
ClawHub: https://clawhub.ai/steipete/skills/nano-banana-pro

Summary

generate_image.py saves the generated image to the path supplied with --filename without rejecting symlinks or checking that the resolved path stays inside the working directory.

If an untrusted repository contains result.png as a symlink to a file outside the repository, running the skill from that repository with --filename result.png follows the link and overwrites the target with PNG data. This can corrupt or destroy files that the OpenClaw process can write.

Steps to reproduce

1. Create an isolated test directory:

   mkdir -p /tmp/nbp-test/workspace /tmp/nbp-test/outside
   printf 'SAFE TEST SENTINEL\n' > /tmp/nbp-test/outside/victim.txt
   ln -s ../outside/victim.txt /tmp/nbp-test/workspace/result.png
   

2. From the workspace, run the skill with a valid Gemini API key available through GEMINI_API_KEY:

   cd /tmp/nbp-test/workspace
   python3 /path/to/nano-banana-pro/scripts/generate_image.py \
     --prompt "A simple blue square on a plain light background." \
     --filename result.png
   

3. Check the target:

   file /tmp/nbp-test/outside/victim.txt
   

Expected behavior

The script should reject symlink outputs and any resolved output path outside the working directory.

Actual behavior

The script follows result.png and writes the generated PNG to /tmp/nbp-test/outside/victim.txt.

Impact

An attacker who can provide or modify repository contents can place the output symlink in the repository. If a user or agent runs image generation from that repository using the symlink name, files outside the repository may be overwritten or corrupted, subject to the OpenClaw process's file permissions.

Affected versions

Confirmed in nano-banana-pro 1.0.0 and 1.0.1.

Suggested fix

Reject symlink outputs and verify the resolved destination remains within the intended output directory before writing. Consider requiring an explicit overwrite option when the destination already exists.