nano-banana2
Fail
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: HIGHCREDENTIALS_UNSAFECOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The scripts
scripts/img2img.pyandscripts/nano_banana2.pyboth contain a hardcoded Google Gemini API key (AIzaSyBn_AbjUeM4ZRcOOihp4Jdkt4sRdo--Kak). Storing API keys in plain text within scripts is a high-risk practice as it allows unauthorized access to the service and potential cost or quota abuse.\n- [COMMAND_EXECUTION]: The execution logic inSKILL.mdinvokes Python scripts using shell commands that interpolate the user's prompt into a quoted string (e.g.,--prompt \"用户的图片描述\"). This method is vulnerable to shell command injection if a user provides a prompt containing shell metacharacters (such as backticks, semicolons, or dollar signs), which could lead to arbitrary code execution on the host machine.
Recommendations
- AI detected serious security threats
Audit Metadata