nano-banana-2
Pass
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates image generation by executing the
runcomfyCLI tool with structured JSON input. The documentation explicitly notes that the CLI avoids shell expansion to mitigate command injection risks. - [EXTERNAL_DOWNLOADS]: The skill references the installation of the
@runcomfy/clipackage and specifies that generated assets are downloaded from authorized vendor domains, including*.runcomfy.netand*.runcomfy.com. - [CREDENTIALS_UNSAFE]: The skill provides instructions for standard, secure secret management, recommending the use of environment variables (
RUNCOMFY_TOKEN) or owner-restricted configuration files (~/.config/runcomfy/token.json) rather than hardcoding credentials. - [DATA_EXFILTRATION]: Outbound network operations are transparently documented as limited to the author's official API endpoints for request submission and asset retrieval.
Audit Metadata