ads-photoshoot
Pass
Audited by Gen Agent Trust Hub on Apr 5, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the /banana CLI and nanobanana-mcp tools to perform image generation and environment setup tasks. These are documented dependencies required for the skill's primary functionality.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by interpolating user-provided product descriptions and external image URLs into prompts for an image generation model. 1. Ingestion points: User input (Step 1) and brand-profile.json (Step 2). 2. Boundary markers: Absent. 3. Capability inventory: Image generation and file system writes to ./product-photos/. 4. Sanitization: Absent. This represents a low-risk surface common to image-generation skills.
- [SAFE]: Data access is restricted to the current working directory for branding assets and tool-specific configuration files (~/.banana/costs.json) for expenditure reporting.
Audit Metadata