blog-image
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and configures the
@ycse/nanobanana-mcppackage from the NPM registry usingnpx. The setup script specifically pins the package to version1.1.1to mitigate supply chain risks. - [COMMAND_EXECUTION]: The skill utilizes shell commands for
magickorconvert(ImageMagick) to perform post-processing tasks such as resizing images, converting formats to WebP or AVIF, and cropping for social media. These are standard operations for image management. - [DATA_EXPOSURE]: The
setup_image_mcp.pyscript includes advanced safety logic for handling the Google AI API key. It sets file permissions to0600(user-private) when writing configurations, masks the key in terminal output to prevent leakage in logs, and refuses to write literal keys into files tracked by Git.
Audit Metadata