nano-banana-2

SUSPICIOUS: The skill's image-generation behavior matches its stated purpose, but it routes prompts, images, and API credentials through an AI Hive intermediary rather than the official Google Gemini/Nano Banana API endpoints. Install trust is mostly benign, but the third-party gateway and unverifiable official relationship create medium risk around credential forwarding and commercial media data flow.

No malicious code behavior is demonstrated in this fragment because it contains only static configuration. However, it embeds a plaintext API key and an external service base URL, creating a significant credential-leak and unauthorized-access risk if used by surrounding code or if the secret is reused elsewhere. Additional context (how this config is loaded and how requests are made) is required to assess whether the external calls are legitimate and whether the key is scoped/rotated appropriately.