Skills
skills/skills-collective/skills/nano-banana-edit/Gen Agent Trust Hub

nano-banana-edit

Pass

Audited by Gen Agent Trust Hub on Jul 13, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of an external global npm package, @runcomfy/cli, to interface with the RunComfy Model API.
  • [COMMAND_EXECUTION]: The instructions direct the agent to invoke the runcomfy command-line tool to perform image editing tasks.
  • [PROMPT_INJECTION]: The skill processes external image URLs, which are documented as potential vectors for indirect prompt injection.
  • Ingestion points: image_urls parameter in the runcomfy run command.
  • Boundary markers: Prompt instructions and external URLs are encapsulated within a JSON string passed to the CLI.
  • Capability inventory: The agent uses shell command execution via the runcomfy CLI to interact with remote models.
  • Sanitization: The CLI handles JSON encoding of the input to mitigate shell injection risks.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 13, 2026, 07:38 AM
Security Audit — agent-trust-hub — nano-banana-edit