nano-banana

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The link points to a third‑party GitHub repository (not an official vendor site) that would be installed and executed as an unverified Gemini CLI extension (including commands that auto‑approve actions), so while it’s not an obvious direct malware host it is potentially risky without vetting the repo contents and maintainer reputation.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill requires installing and using the nanobanana Gemini CLI extension via the runtime install command (gemini extensions install https://github.com/gemini-cli-extensions/nanobanana), which fetches and installs remote code that will be executed and used to control the agent's image-generation commands, so this is a runtime external dependency that executes remote code.