nano-banana-2-1
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses a bash script (
scripts/generate_image.sh) to interact with the vendor's image generation API atai-factory.frevana.com. Authentication is handled securely via environment variables or CLI flags using Bearer tokens, and user input is correctly handled to prevent injection. - [COMMAND_EXECUTION]: The bash script executes
curlto perform network operations andfindto locate local images. These commands are constructed using shell arrays and controlled arguments, providing protection against command injection. - [EXTERNAL_DOWNLOADS]: The script downloads reference images from user-supplied URLs. It enforces a 50MB size limit and verifies that the downloaded content matches a supported image format (PNG, JPEG, WebP) using magic byte verification before processing.
- [DYNAMIC_EXECUTION]: Small, hardcoded Python snippets are executed locally to perform technical tasks like file size checking, magic byte validation, and JSON parsing. This is a secure implementation used for local data validation and does not involve remote code execution.
Audit Metadata