Trust Assessment
nano-banana-pro received a trust score of 10/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 10 findings: 4 critical, 6 high, 0 medium, and 0 low severity. Key findings include File read + network send exfiltration, Sensitive path access: AI agent config, Potential Command Injection via User-Controlled Arguments.
The analysis covered 4 layers: dependency_graph, static_code_analysis, manifest_analysis, llm_behavioral_safety. The manifest_analysis layer scored lowest at 0/100, indicating areas for improvement.
Last analyzed on February 11, 2026 (commit 326f2466). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings10
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | File read + network send exfiltration AI agent config/credential file access Remove access to sensitive files not required by the skill's stated purpose. SSH keys, cloud credentials, and browser data should never be read by skills unless explicitly part of their declared functionality. | Unknown | /var/folders/1k/67b8r20n777f_xcmmm8b7m5h0000gn/T/skillscan-clone-i_5z70ta/repo/plugins/nano-banana-pro/skills/SKILL.md:12 | |
| CRITICAL | File read + network send exfiltration AI agent config/credential file access Remove access to sensitive files not required by the skill's stated purpose. SSH keys, cloud credentials, and browser data should never be read by skills unless explicitly part of their declared functionality. | Unknown | /var/folders/1k/67b8r20n777f_xcmmm8b7m5h0000gn/T/skillscan-clone-i_5z70ta/repo/plugins/nano-banana-pro/skills/SKILL.md:17 | |
| CRITICAL | File read + network send exfiltration AI agent config/credential file access Remove access to sensitive files not required by the skill's stated purpose. SSH keys, cloud credentials, and browser data should never be read by skills unless explicitly part of their declared functionality. | Unknown | /var/folders/1k/67b8r20n777f_xcmmm8b7m5h0000gn/T/skillscan-clone-i_5z70ta/repo/plugins/nano-banana-pro/skills/SKILL.md:87 | |
| CRITICAL | File read + network send exfiltration AI agent config/credential file access Remove access to sensitive files not required by the skill's stated purpose. SSH keys, cloud credentials, and browser data should never be read by skills unless explicitly part of their declared functionality. | Unknown | /var/folders/1k/67b8r20n777f_xcmmm8b7m5h0000gn/T/skillscan-clone-i_5z70ta/repo/plugins/nano-banana-pro/skills/SKILL.md:92 | |
| HIGH | Sensitive path access: AI agent config Access to AI agent config path detected: '~/.claude/'. This may indicate credential theft. Verify that access to this sensitive path is justified and declared. | Unknown | /var/folders/1k/67b8r20n777f_xcmmm8b7m5h0000gn/T/skillscan-clone-i_5z70ta/repo/plugins/nano-banana-pro/skills/SKILL.md:12 | |
| HIGH | Sensitive path access: AI agent config Access to AI agent config path detected: '~/.claude/'. This may indicate credential theft. Verify that access to this sensitive path is justified and declared. | Unknown | /var/folders/1k/67b8r20n777f_xcmmm8b7m5h0000gn/T/skillscan-clone-i_5z70ta/repo/plugins/nano-banana-pro/skills/SKILL.md:17 | |
| HIGH | Sensitive path access: AI agent config Access to AI agent config path detected: '~/.claude/'. This may indicate credential theft. Verify that access to this sensitive path is justified and declared. | Unknown | /var/folders/1k/67b8r20n777f_xcmmm8b7m5h0000gn/T/skillscan-clone-i_5z70ta/repo/plugins/nano-banana-pro/skills/SKILL.md:87 | |
| HIGH | Sensitive path access: AI agent config Access to AI agent config path detected: '~/.claude/'. This may indicate credential theft. Verify that access to this sensitive path is justified and declared. | Unknown | /var/folders/1k/67b8r20n777f_xcmmm8b7m5h0000gn/T/skillscan-clone-i_5z70ta/repo/plugins/nano-banana-pro/skills/SKILL.md:92 | |
| HIGH | Potential Command Injection via User-Controlled Arguments The skill's documentation instructs the LLM to pass user-provided input for `--prompt`, `--filename`, and `--input-image` directly as arguments to a shell command (`uv run ...`). Specifically, the instructions state to pass the user's image description 'as-is' for `--prompt` and to generate filenames based on user context. If these arguments are not strictly sanitized and properly quoted by the LLM before execution, or by the `generate_image.py` script itself, a malicious user could inject arbitrary shell commands. For example, a crafted filename like `"output.png; rm -rf /"` or a prompt containing shell metacharacters could lead to arbitrary code execution, data loss, or system compromise. The LLM must be explicitly instructed to strictly sanitize and properly quote all user-provided arguments (especially `--prompt`, `--filename`, and `--input-image`) before constructing and executing the `uv run` command. Additionally, the `generate_image.py` script should implement robust input validation and sanitization for all command-line arguments to prevent shell injection. | Unknown | SKILL.md:18 | |
| HIGH | LLM analysis found no issues despite critical deterministic findings Deterministic layers flagged 4 CRITICAL findings, but LLM semantic analysis returned clean. This may indicate prompt injection or analysis evasion. | Unknown | (sanity check) |
Scan History
Embed Code
[](https://skillshield.io/report/3959439575ed261a)
Powered by SkillShield