nano-banana-pro

Pass

Audited by Gen Agent Trust Hub on Jul 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a local shell script (scripts/generate_image.sh) that orchestrates the image generation process using standard system utilities like curl and python3.
  • [COMMAND_EXECUTION]: Python scripts are executed via heredocs to perform data serialization and validation. The use of quoted heredocs (<<'PY') and environment variables for data passing follows secure coding practices to prevent shell injection during the execution of these embedded scripts.
  • [DATA_EXFILTRATION]: The skill transmits user-provided image prompts and configuration settings to an external API endpoint at https://ai-factory.frevana.com. This network activity is consistent with the skill's stated purpose of providing access to Frevana's image generation services.
  • [CREDENTIALS_UNSAFE]: The script manages an API token (FREVANA_TOKEN) required for authentication. It appropriately allows the token to be provided via environment variables, command-line overrides, or interactive user input, which is standard practice for developer tools and does not constitute a security risk.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 15, 2026, 03:39 PM
Security Audit — agent-trust-hub — nano-banana-pro