nanobanana-image-generation
Warn
Audited by Socket on Sep 21, 2026
1 alert found:
AnomalyAnomalySKILL.md
LOWAnomalyLOW
SKILL.md
SUSPICIOUS. The core image/plot capabilities match the stated purpose and the official Google API flow is coherent, but the optional third-party Gemini-compatible endpoint introduces a meaningful data-flow risk because user prompts, input images, and API credentials can be sent to a non-official service. Disclosure and explicit opt-in keep this from malicious classification, but the proxy design is still disproportionate compared with direct official API use.
Confidence: 93%Severity: 56%
Audit Metadata