nanobanana-ppt

Suspicious as a transitive-trust catalog stub: its stated purpose is plausible, but the real functionality is outsourced to an upstream GitHub skill bundle that is not pinned or reviewed here. No direct credential theft or exfiltration is shown in this entry, yet installing another skill into the active agent is a meaningful supply-chain risk.