nano-banana
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The script
scripts/generate-image.jsdynamically installs thesharpimage processing library from the public npm registry if it is not already present on the system. - [COMMAND_EXECUTION]: The skill uses
node:child_process.execSyncto run thenpm installcommand for automated dependency management. - [SAFE]: The skill transmits image data to Google's Gemini API (
aiplatform.googleapis.com) and fetches credentials from the vendor's internal secrets endpoint, both of which are trusted operations within the skill's context.
Audit Metadata