nano-banana-edit
Pass
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
@runcomfy/clipackage from the npm registry. This is a standard and safe procedure for accessing RunComfy's official services and model endpoints.\n- [COMMAND_EXECUTION]: The skill utilizes theruncomfycommand-line utility to transmit image editing requests to the RunComfy Model API. The documentation explicitly highlights that the CLI transmits JSON bodies directly over HTTPS without shell-expanding user prompts, which effectively prevents command injection vulnerabilities from user-supplied content.\n- [SAFE]: Secure handling of API credentials is documented through the use of environment variables and configuration files with restricted file permissions. The skill identifies and defines input boundaries for user-supplied prompts and image URLs, ensuring they are processed as data rather than instructions.
Audit Metadata