nano-banana-2
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill directs users to install the
beltCLI vianpx skills add belt-sh/cliand references a remote installation guide athttps://raw.githubusercontent.com/inference-sh/skills/refs/heads/main/cli-install.md. These resources originate from an external organization not included in the primary trusted vendor list.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text prompts and image URLs which are interpolated into shell commands via thebeltCLI tool.\n - Ingestion points: Data enters the skill via the
prompt,images,aspect_ratio,resolution, andenable_google_searchfields defined inSKILL.md.\n - Boundary markers: The skill uses JSON formatting for input parameters (e.g.,
--input '{"prompt": "..."}'), which provides some structure but does not fully prevent injection if inputs are not properly escaped by the underlying tool.\n - Capability inventory: The skill utilizes
Bash(belt *)to execute commands, providing a restricted shell environment for interacting with the inference model.\n - Sanitization: There is no explicit mention of prompt sanitization, validation, or escaping logic within the skill instructions to prevent malicious content from influencing the tool's behavior.
Audit Metadata