Nano banana korean rendering
Analysis
This skill appears aligned with its stated image text-rendering purpose, but it installs dependencies/downloads fonts and sends prompts or images to Gemini using a user-provided API key.
Findings (5)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
execSync('npm install', { cwd: __dirname, stdio: 'inherit' });The setup script runs a shell command to install dependencies. It is user-directed and purpose-aligned, but npm install can execute third-party package lifecycle behavior.
const response = await fetch(url, { redirect: 'follow' });The setup script downloads font files from predefined external URLs. This supports the stated font-rendering purpose, but the artifacts do not show integrity pinning for those downloaded files.
비라틴 문자가 감지되면 반드시 전체 파이프라인 (detect→analyze→render→generate)을 실행한다
The instruction directs the agent to run the full tool chain when matching text is detected. This is central to the skill, but users should understand it can invoke external API calls and create output files.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
`GEMINI_API_KEY` | ⭐ 필수 | Gemini Flash(분석) + Gemini Image(생성) 모두에 사용
The skill requires a Gemini API key for analysis and image generation. This is appropriate for the Gemini integration, but the registry metadata lists no required env vars or primary credential.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
프리렌더링 PNG를 **첫 번째 참조 이미지**로 Gemini에 전달
The skill sends the rendered text image, and potentially user reference images, to Gemini as part of the disclosed generation workflow.
