nano-banana
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPERSISTENCE
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill guides the execution of a remote script using
curl -fsSL https://bun.sh/install | bashto install the Bun runtime environment if it is missing. Because this download targets Bun's official and well-known domain, it constitutes a standard technology setup step rather than an untrusted execution vector. - [COMMAND_EXECUTION]: The installation workflow runs local setup commands, including cloning the vendor's official repository (
git clone https://github.com/kingbootoshi/nano-banana-2-skill.git) and managing packages viabun installandbun link. These commands are standard for installing and linking a node-based command-line tool. - [PERSISTENCE]: The fallback installation instructions append a PATH export (
export PATH="$HOME/.local/bin:$PATH") to the user's~/.zshrcfile. While modifications to shell profiles can be used for persistence, this configuration is a standard and benign approach to ensuring the shell can discover locally installed binaries.
Audit Metadata