nanobanana-infographic

Pass

Audited by Gen Agent Trust Hub on Apr 11, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes local Python scripts, specifically scripts/build_variant_pack.py and scripts/probe_gemini_image_api.py, to automate the transformation of structured brief data into infographic prompts and to facilitate local testing of those prompts.
  • [EXTERNAL_DOWNLOADS]: The scripts/probe_gemini_image_api.py utility is designed to communicate with the official Google Gemini API at generativelanguage.googleapis.com for the purpose of image generation, which is the primary intended function of the skill.
  • [PROMPT_INJECTION]: The skill ingests untrusted data from user-defined JSON files (e.g., templates/brief.json) and interpolates these values into prompt templates. While this creates a potential surface for indirect prompt injection, the risk is mitigated by the skill's narrow focus on image generation and the clear separation between data and instructions in the provided templates.
  • [CREDENTIALS_UNSAFE]: Security best practices are followed for credential management; the skill expects the GEMINI_API_KEY to be provided via environment variables rather than being hardcoded in scripts or configuration files.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 11, 2026, 03:51 AM