nano-banana

Pass

Audited by Gen Agent Trust Hub on Sep 2, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references the installation of the belt CLI and related functionality from external repositories, specifically pointing to npx skills add belt-sh/cli and documentation hosted on raw.githubusercontent.com/inference-sh/.
  • [COMMAND_EXECUTION]: The skill uses the Bash tool to execute belt commands, which are scoped to the belt binary as defined in the allowed-tools frontmatter. These commands handle authentication (belt login) and interface with image generation models (belt app run).
  • [INDIRECT_PROMPT_INJECTION]: The skill provides a surface for processing user-defined prompts and external image URLs that are passed to the Gemini models.
  • Ingestion points: User-provided text prompts and image URLs are accepted via the --input argument in various belt app run examples in SKILL.md.
  • Boundary markers: No explicit delimiters or instructions are used to separate user input from model instructions within the skill's documentation.
  • Capability inventory: The skill is authorized to execute belt CLI commands via the Bash tool to communicate with remote inference services.
  • Sanitization: Input prompts and image links are passed directly to the CLI tool without intermediate validation or sanitization within the skill's instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 2, 2026, 02:19 PM
Security Audit — agent-trust-hub — nano-banana