seo-image-gen
Pass
Audited by Gen Agent Trust Hub on May 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python scripts (
scripts/cost_tracker.py,scripts/presets.py) to log generation costs and manage brand configuration files stored in the user's home directory (~/.banana/). - [COMMAND_EXECUTION]: Includes documentation and automated examples for image post-processing using
magick(ImageMagick) andffmpegfor tasks such as WebP conversion, resizing, and background removal. - [EXTERNAL_DOWNLOADS]: References the installation of the
bananaextension and the@ycse/nanobanana-mcpserver from public repositories. These dependencies are required for the skill's primary purpose of image generation. - [PROMPT_INJECTION]: The skill uses user-supplied descriptions to dynamically construct a 'Reasoning Brief' for the image generation model. This represents an ingestion surface for indirect prompt injection where a malicious description could attempt to influence model behavior, though the impact is limited to the generation of the specific image.
Audit Metadata