Ad Designer

This skill appears to implement the advertised ad-image workflow, but there are packaging and install red flags you should address before running it. What to check before installing/using: - Confirm prerequisites SKILL.md mentions: ensure you actually have GEMINI_API_KEY and the nano-banana-pro skill (check ~/.codex/skills/nano-banana-pro/scripts/generate_image.py). The registry metadata should list GEMINI_API_KEY and any required binaries — ask the publisher to correct the manifest. - Do NOT blindly run curl | sh. If you must install 'uv' from https://astral.sh/uv/install.sh, first download the script, inspect its contents, and verify the source/trustworthiness. Prefer package manager installs or official release artifacts. - Review the local script generate_image.py (and any other code from nano-banana-pro) before executing to see what network calls it makes and what data it may send. - Use the least-privilege API key: create a key scoped for image generation only, and avoid exposing broader Google Cloud credentials. - Because the skill reads files under your home and /tmp, ensure those files don't contain secrets you wouldn't want the skill to access, and consider running initial tests in a sandboxed environment or VM. If you cannot verify the installer and the origin of the skill (source is unknown), treat it cautiously and ask the publisher for a provenance/manifest update and signed release artifacts before proceeding.