blog-image

Pass

Audited by Gen Agent Trust Hub on Jun 13, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads and configures the @ycse/nanobanana-mcp package from the NPM registry using npx. The setup script specifically pins the package to version 1.1.1 to mitigate supply chain risks.
  • [COMMAND_EXECUTION]: The skill utilizes shell commands for magick or convert (ImageMagick) to perform post-processing tasks such as resizing images, converting formats to WebP or AVIF, and cropping for social media. These are standard operations for image management.
  • [DATA_EXPOSURE]: The setup_image_mcp.py script includes advanced safety logic for handling the Google AI API key. It sets file permissions to 0600 (user-private) when writing configurations, masks the key in terminal output to prevent leakage in logs, and refuses to write literal keys into files tracked by Git.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 13, 2026, 08:43 AM
Security Audit — agent-trust-hub — blog-image