nano-banana-pro
Pass
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a bash script, generate.sh, that facilitates image generation by executing standard system utilities such as curl for network requests and base64 for data encoding. These operations are scoped strictly to the skill's documented functionality.
- [EXTERNAL_DOWNLOADS]: The helper script communicates with Google's official Gemini API (generativelanguage.googleapis.com) to process image generation prompts. This interaction with a well-known service is the intended purpose of the skill.
- [CREDENTIALS_UNSAFE]: The skill implements a secure API key resolution hierarchy, checking command-line arguments, environment variables, and a local configuration file (~/.openclaw/openclaw.json). No sensitive credentials or secrets are hardcoded within the source files.
Audit Metadata