nanobanana-infographic
Pass
Audited by Gen Agent Trust Hub on Apr 11, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes local Python scripts, specifically
scripts/build_variant_pack.pyandscripts/probe_gemini_image_api.py, to automate the transformation of structured brief data into infographic prompts and to facilitate local testing of those prompts. - [EXTERNAL_DOWNLOADS]: The
scripts/probe_gemini_image_api.pyutility is designed to communicate with the official Google Gemini API atgenerativelanguage.googleapis.comfor the purpose of image generation, which is the primary intended function of the skill. - [PROMPT_INJECTION]: The skill ingests untrusted data from user-defined JSON files (e.g.,
templates/brief.json) and interpolates these values into prompt templates. While this creates a potential surface for indirect prompt injection, the risk is mitigated by the skill's narrow focus on image generation and the clear separation between data and instructions in the provided templates. - [CREDENTIALS_UNSAFE]: Security best practices are followed for credential management; the skill expects the
GEMINI_API_KEYto be provided via environment variables rather than being hardcoded in scripts or configuration files.
Audit Metadata