nano-banana

SUSPICIOUS. The skill is functionally aligned with its stated image-generation purpose and appears to route data to the expected Google API, but its install footprint is heavier than necessary: unpinned curl|bash for Bun, cloning executable code from a personal GitHub repo, global linking, and optional PATH modification. This is mainly a supply-chain and execution-trust issue, not confirmed malware or credential exfiltration.