Skills
Navigate
skills/runcomfy-com/skills/nano-banana-2/Gen Agent Trust Hub

nano-banana-2

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill directs the agent to execute the runcomfy CLI tool to interact with the image generation model. These commands communicate with vendor-controlled infrastructure at runcomfy.com and runcomfy.net.
  • [INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided text prompts that are interpolated into a command-line request. 1. Ingestion points: The <user prompt> placeholder within the command examples in SKILL.md. 2. Boundary markers: The prompt is encapsulated within a JSON object passed to the CLI's --input argument. 3. Capability inventory: Local command execution via the runcomfy CLI and network requests to the vendor's API endpoints. 4. Sanitization: The documentation specifies that the CLI transmits the JSON body directly to the API to prevent shell expansion, mitigating common command injection vectors.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 04:16 AM