skills/infsh-skills/skills/nano-banana-2/Socket

nano-banana-2

Warn

Audited by Socket on Jul 22, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS. The model usage itself matches the stated purpose, but the skill’s actual trust chain is not clean: it asks users to install a separate `belt-sh/cli` skill not verified by official inference.sh documentation, then to authenticate and route data through that external CLI. This is mainly a supply-chain and credential-forwarding concern, not confirmed malware.

Confidence: 85%Severity: 78%

Audit Metadata

Analyzed At

Jul 22, 2026, 11:52 AM

Package URL

pkg:socket/skills-sh/infsh-skills%2Fskills%2Fnano-banana-2%2F@61375209216e00a360bc7448963535837a6d65bfb28374aa195f6e04eab66ac9