nano-banana-pro-product-image
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions and a Python script (
scripts/imagegen.py) intended to be executed via the command line to perform image generation tasks, including initialization, image generation, and task status polling. - [EXTERNAL_DOWNLOADS]: The
scripts/imagegen.pyscript contains functionality to download generated images and media results from the AI Hive service (ai-hive.iclip.cn) to the local filesystem (defaulting to~/Downloads/AiHive). - [DATA_EXPOSURE_&_EXFILTRATION]: The skill manages an API key (
AI_HIVE_API_KEY) for authentication. It implements a secure local storage mechanism in~/.ai-hive/config.jsonusingchmod 600to prevent unauthorized access by other users on the system. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided text prompts and external image references which are interpolated into API requests. While this presents a surface for injection, the skill acts as a pass-through to the backend model service without performing high-privilege local operations based on the model's output.
Audit Metadata