nano-banana-pro
Pass
Audited by Gen Agent Trust Hub on Apr 18, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill manages its dependencies through 'uv', specifically requiring the 'google-genai' and 'pillow' libraries. These are official and well-known packages used for interacting with Google's AI services and image processing, respectively.
- [COMMAND_EXECUTION]: The skill facilitates image generation by executing a local Python script via 'uv run'. The script's logic is transparent, focusing exclusively on API interaction and standard file system operations for saving output images.
- [DATA_EXFILTRATION]: While the skill sends prompts and images to an external service, it targets Google's official Gemini API endpoints. This communication is essential for its primary function and does not involve unauthorized access or transmission of sensitive local data.
- [CREDENTIALS_UNSAFE]: The skill handles the 'GEMINI_API_KEY' securely by encouraging the use of environment variables or a local configuration file. This aligns with best practices for secret management and avoids the risks associated with hardcoded credentials.
- [PROMPT_INJECTION]: The instructions provided in the markdown body are purely operational and do not attempt to bypass safety filters, extract system prompts, or otherwise manipulate the core behavior of the AI agent.
Audit Metadata