nano-banana-pro
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local shell script (
scripts/generate_image.sh) that orchestrates the image generation process using standard system utilities likecurlandpython3. - [COMMAND_EXECUTION]: Python scripts are executed via heredocs to perform data serialization and validation. The use of quoted heredocs (
<<'PY') and environment variables for data passing follows secure coding practices to prevent shell injection during the execution of these embedded scripts. - [DATA_EXFILTRATION]: The skill transmits user-provided image prompts and configuration settings to an external API endpoint at
https://ai-factory.frevana.com. This network activity is consistent with the skill's stated purpose of providing access to Frevana's image generation services. - [CREDENTIALS_UNSAFE]: The script manages an API token (
FREVANA_TOKEN) required for authentication. It appropriately allows the token to be provided via environment variables, command-line overrides, or interactive user input, which is standard practice for developer tools and does not constitute a security risk.
Audit Metadata