Nano Banana Pro
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill coherently implements a NanoPhoto image-generation client, with expected use of a NanoPhoto API key and remote API calls that may consume credits.
This appears safe for its stated purpose if you are comfortable giving it a NanoPhoto API key. Use the secure environment-variable setup, do not paste the key into chat, avoid private or sensitive images, and be aware that generation requests may consume credits.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If installed with a valid key, the agent can submit NanoPhoto generation requests using that account.
The script authenticates to NanoPhoto using a bearer API key. This is expected for the service, but it grants the skill access to act through the user's NanoPhoto account.
api_key = args.api_key or os.environ.get("NANOPHOTO_API_KEY") ... "Authorization": f"Bearer {api_key}"Store the key only in the skill's secure environment setting, avoid passing it on the command line or in chat, and rotate the key if it is exposed.
Repeated or high-quality generations may use account credits.
The API requests can consume NanoPhoto credits. This is disclosed and aligned with image generation, but users should notice the cost-bearing behavior.
Credits are pre-deducted and automatically refunded if generation fails.
Confirm the prompt, image quality, and number of requested generations before running the skill, especially for 2K or 4K outputs.
Users are relying on the packaged artifact and publisher claims rather than a verified source repository.
The registry does not identify a source repository or verified source location. The included script is reviewable and coherent, but provenance is still a user-trust consideration.
Source: unknown
Install only if you trust the publisher/package source, and review the included script before providing an API key.