NanoBanana PPT Skills

Summary of what to check before installing/using: - Do not paste API keys into chat prompts. The README contains example prompts that include 'MY API KEYS' — sending actual keys into conversation will leak them to the agent/skill. - Verify the repository/source before cloning. The skill references a GitHub repo; confirm the URL and owner are legitimate and review the repo on GitHub rather than relying solely on the SKILL.md. - Inspect install scripts (install_as_skill.sh, run.sh) and any scripts that modify ~/.zshrc or write .env files before executing them. Ensure they do not add unexpected remote endpoints, telemetry, or write secrets to shared locations. - Prefer manual installation: create a virtualenv, run pip installs yourself, and populate a local .env that you control. Avoid letting an agent perform the git clone + install steps with secrets provided in prompts. - Limit where API keys are stored: prefer a skill-specific .env in the skill directory or system environment variables with limited scope. Be cautious because the code's described search-upward behavior for .env could pick up keys from unrelated projects. - If you need only image generation, skip providing KLING keys (video service) unless you plan to use video features. - If you decide to proceed, run the scripts in a sandboxed environment first (or examine them line-by-line). If anything in the scripts looks like it exfiltrates data to unknown endpoints, stop and revoke any keys that were used. Overall: functionality looks coherent with the stated feature set, but several instruction-level practices (encouraging keys in prompts, modifying shell startup files, searching multiple .env locations) are risky — treat this skill as suspicious until you manually review the code and scripts.