nano-banana

Pass

Audited by Gen Agent Trust Hub on Jun 30, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The Python script communicates with the Google Generative Language API (generativelanguage.googleapis.com) to generate and process images. This is the intended purpose of the skill and targets a well-known service.
  • [COMMAND_EXECUTION]: The skill documentation provides instructions for the agent to execute a local Python script (scripts/nano_banana.py) using the python3 command. This script processes user prompts and generates files based on CLI arguments.
  • [DATA_EXFILTRATION]: In 'Edit Mode' and 'Deck Mode', the script reads local image files provided by the user and transmits them to the Gemini API as base64-encoded data. This is a legitimate functional requirement for the skill's style-transfer and reference image features.
  • [SAFE_PRACTICES]: The script includes safety checks such as validating image file extensions before reading and using a versioning system to prevent overwriting existing files on disk.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 30, 2026, 11:31 AM
Security Audit — agent-trust-hub — nano-banana