Nano Banana Pro

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:21 PM UTC
• Version:
  1.0.5

Overview

This is a straightforward Gemini image-generation helper with expected API use and local image output, but users should handle API keys and uploaded images carefully.

Install only if you are comfortable sending prompts and any input images to Google's Gemini service. Prefer setting GEMINI_API_KEY in your environment instead of passing the key on the command line, and choose output filenames carefully because the script will create parent directories and write the generated PNG there.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill instructs users to provide `--api-key KEY` on the command line, which can leak secrets through shell history, process listings, logs, or terminal recording systems. Because the document presents this as a normal usage path without warning, users may unknowingly expose live API credentials.

VirusTotal

63/63 vendors flagged this skill as clean.