Trust Assessment
nano-banana-pro received a trust score of 55/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 4 findings: 0 critical, 3 high, 0 medium, and 1 low severity. Key findings include Sensitive path access: AI agent config, Node lockfile missing, Arbitrary File Write via --filename argument.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings4
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Sensitive path access: AI agent config Access to AI agent config path detected: '~/.clawdbot/'. This may indicate credential theft. Verify that access to this sensitive path is justified and declared. | Static | skills/autogame-17/nano-banana-ultra/SKILL.md:23 | |
| HIGH | Arbitrary File Write via --filename argument The skill allows writing to arbitrary file paths on the system. The `--filename` argument, which is user-controlled, is directly used to construct the output path (`Path(args.filename)`) and save the generated image (`image.save(str(output_path), 'PNG')`). An attacker could specify a path like `/etc/passwd` or `../../sensitive_data.txt` to overwrite system files or write to arbitrary locations, leading to data corruption, denial of service, or potentially command injection if executable files are overwritten. Sanitize the `--filename` argument to ensure it only specifies a basename or a path within a designated, restricted output directory. Prevent path traversal sequences (e.g., `../`) and absolute paths. For example, enforce that the filename is only a basename or prepend a secure base directory. | LLM | scripts/generate_image.py:159 | |
| HIGH | Arbitrary File Read via --input-image argument The skill allows reading arbitrary files from the filesystem. The `--input-image` argument, which is user-controlled, is directly used to open image files (`PILImage.open(img_path)`). An attacker could specify paths to sensitive system files (e.g., `/etc/passwd`, `/root/.ssh/id_rsa`) or other user data, leading to data exfiltration. The content of these files would be read by the Pillow library, potentially causing errors or being processed by the script. Sanitize the `--input-image` argument to ensure it only specifies paths within a designated, restricted input directory. Prevent path traversal sequences (e.g., `../`) and absolute paths, or implement strict validation of file extensions and content types. | LLM | scripts/generate_image.py:116 | |
| LOW | Node lockfile missing package.json is present but no lockfile was found (package-lock.json, pnpm-lock.yaml, or yarn.lock). Commit a lockfile for deterministic dependency resolution. | Dependencies | skills/autogame-17/nano-banana-ultra/package.json |
Scan History
Embed Code
[](https://skillshield.io/report/be831c59300bc86c)
Powered by SkillShield