nano-banana

SUSPICIOUS. The skill’s purpose broadly matches its capabilities: it needs a Gemini API key, image prompts, local file output, and an MCP server. The main concern is install trust: it recommends running an npm package via `npx` without strong evidence that the exact package is the official publisher-backed implementation, and it forwards the Gemini API key to that external MCP server process. Data flow to Google is expected for image generation, but the package provenance ambiguity and overstated claim that images are not stored externally make the footprint less trustworthy than a fully verified official integration.