[Security] nano-banana-pro follows output symlinks and overwrites files outside the working directory

从 skills/nano-banana-pro/scripts/generate_image.py 开始，在写入图像之前，--filename 参数在这里被转换为输出路径。将解析后的目标位置（os.path.realpath）与工作目录进行比较，当目标是符号链接或逃逸出工作目录时跳过或拒绝；该 issue 中建议的修复还提到了针对已存在目标的显式覆盖标志。按照复现步骤验证：在临时工作区中创建符号链接，运行脚本，并确认工作区外部的哨兵文件未被更改。完成的标准是：符号链接的情况会以清晰的错误被拒绝，同时正常的输出文件名仍能正常工作。

Hi, I found a symlink-following issue in the nano-banana-pro skill that can overwrite files outside the working directory.
GitHub: https://github.com/steipete/agent-scripts/tree/main/skills/nano-banana-pro
ClawHub: https://clawhub.ai/steipete/skills/nano-banana-pro

Summary

generate_image.py saves the generated image to the path supplied with --filename without rejecting symlinks or checking that the resolved path stays inside the working directory.

If an untrusted repository contains result.png as a symlink to a file outside the repository, running the skill from that repository with --filename result.png follows the link and overwrites the target with PNG data. This can corrupt or destroy files that the OpenClaw process can write.

Steps to reproduce

1. Create an isolated test directory:

   mkdir -p /tmp/nbp-test/workspace /tmp/nbp-test/outside
   printf 'SAFE TEST SENTINEL\n' > /tmp/nbp-test/outside/victim.txt
   ln -s ../outside/victim.txt /tmp/nbp-test/workspace/result.png
   

2. From the workspace, run the skill with a valid Gemini API key available through GEMINI_API_KEY:

   cd /tmp/nbp-test/workspace
   python3 /path/to/nano-banana-pro/scripts/generate_image.py \
     --prompt "A simple blue square on a plain light background." \
     --filename result.png
   

3. Check the target:

   file /tmp/nbp-test/outside/victim.txt
   

Expected behavior

The script should reject symlink outputs and any resolved output path outside the working directory.

Actual behavior

The script follows result.png and writes the generated PNG to /tmp/nbp-test/outside/victim.txt.

Impact

An attacker who can provide or modify repository contents can place the output symlink in the repository. If a user or agent runs image generation from that repository using the symlink name, files outside the repository may be overwritten or corrupted, subject to the OpenClaw process's file permissions.

Affected versions

Confirmed in nano-banana-pro 1.0.0 and 1.0.1.

Suggested fix

Reject symlink outputs and verify the resolved destination remains within the intended output directory before writing. Consider requiring an explicit overwrite option when the destination already exists.