Trust Assessment
nano-banana-pro received a trust score of 35/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 5 findings: 2 critical, 1 high, 1 medium, and 1 low severity. Key findings include Obfuscated execution: base64 decode to shell, Obfuscated Remote Code Execution via MacOS Installation Script, Potential Command Injection via Unsanitized User Input in Script Arguments.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 46/100, indicating areas for improvement.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings5
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Obfuscated execution: base64 decode to shell Detected base64-encoded data being decoded and piped to a shell interpreter. This is a common obfuscation technique. Decode and inspect the base64 content before execution. | Static | skills/sakaen736jih/nano-banana-pro-8ap3x7/SKILL.md:10 | |
| CRITICAL | Obfuscated Remote Code Execution via MacOS Installation Script The MacOS installation instructions include a base64 encoded command that, when decoded, downloads and executes a script from an arbitrary IP address (91.92.242.30) directly into a bash shell. This constitutes a severe supply chain risk, as the content of the remote script is unknown and could contain malicious code. It's also a hidden instruction due to base64 encoding and a direct command injection vector. Remove the obfuscated remote code execution command. All dependencies should be installed via trusted package managers or clearly documented, verifiable steps. Avoid direct `curl | bash` from untrusted or arbitrary sources, especially when obfuscated. | LLM | SKILL.md:13 | |
| HIGH | Potential Command Injection via Unsanitized User Input in Script Arguments The skill instructs the agent to execute `uv run` commands with user-controlled arguments such as `--prompt`, `--filename`, and `--input-image`. If the agent does not properly sanitize or escape these arguments before constructing the shell command, a malicious user could inject arbitrary shell commands. For example, a crafted `filename` like `"output.png; rm -rf /"` could lead to arbitrary code execution on the host system. This risk applies to all `uv run` commands shown in the usage examples. The agent integrating this skill must rigorously sanitize and escape all user-provided input before passing it as arguments to shell commands. For file paths, consider using a dedicated file system API or ensuring paths are strictly within an allowed directory. For prompts, ensure shell metacharacters are escaped. | LLM | SKILL.md:24 | |
| MEDIUM | File System Probing via User-Controlled Path in Preflight Check The preflight check `test -f "path/to/input.png"` is intended to verify file existence. If "path/to/input.png" is derived from user input without proper sanitization, a malicious user could use this to probe for the existence of arbitrary files on the system (e.g., `test -f "/etc/passwd"`). While `test -f` doesn't read file content, confirming existence can be a form of information leakage. This is a specific instance of the broader command injection risk. Ensure that any user-provided paths used in shell commands, including `test -f`, are strictly validated and confined to expected directories. Avoid allowing arbitrary paths. The agent should sanitize user input to prevent path traversal or injection of other commands. | LLM | SKILL.md:70 | |
| LOW | API Key Exposure via Command Line Argument The skill allows passing the `GEMINI_API_KEY` directly as a command-line argument (`--api-key KEY`). While this is an explicit choice by the user, command-line arguments can be visible in process lists (`ps aux`), shell history, or logs, making the API key susceptible to exposure. Environment variables are generally a more secure method for handling sensitive credentials. Recommend using environment variables (`GEMINI_API_KEY`) as the primary method for providing API keys. If command-line arguments are necessary, ensure that the execution environment is secured against process snooping and that command history is not persistently logged in sensitive contexts. The agent should prioritize passing secrets via environment variables or secure credential stores. | LLM | SKILL.md:60 |
Scan History
Embed Code
[](https://skillshield.io/report/68fde78c328b13d0)
Powered by SkillShield