nano-banana

SUSPICIOUS. The stated purpose is coherent for an image-generation skill, and Google API key usage is proportionate, but the skill depends on third-party npm MCP servers and forwards the Gemini key to them without establishing publisher trust or direct Google-only data flow. This is not confirmed malware, but it carries meaningful supply-chain and credential-forwarding risk.