nano-banana-2
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
runcomfyCLI tool to interact with the Google Nano Banana 2 model. User inputs are encapsulated in a JSON payload during invocation, which is a documented strategy to mitigate shell injection risks. - [CREDENTIALS_UNSAFE]: Authentication is handled via API tokens stored in a restricted configuration file (
~/.config/runcomfy/token.jsonwith 0600 permissions) or through an environment variable (RUNCOMFY_TOKEN), adhering to industry standards for secure secret management in CLI tools. - [EXTERNAL_DOWNLOADS]: The skill relies on the
@runcomfy/clipackage, which is the official utility for the RunComfy service. This is a well-known service dependency necessary for the skill's primary function.
Audit Metadata