{"data":{"skill":{"slug":"blockrunai-nano-banana-blockrun","name":"nano-banana-blockrun","icon":"📦","repo":"https://github.com/BlockRunAI/nano-banana-blockrun/tree/main/","status":"approved","author":"BlockRunAI","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"e815b0c7-551c-4fda-8f0b-b4a00e9ec983","skill_id":"e42aa2bf-8b9d-4ce5-bff9-a88bbb17ea37","version":5,"content_hash":"ed8db9c603b3ecce0b3d2e10685212ab","risk_level":"medium","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"AI analysis failed after multiple attempts - MANUAL REVIEW REQUIRED before publishing. This skill cannot be auto-published until reviewed by a human.","remediation":[],"risk_factor_evidence":[{"factor":"network","evidence":[{"file":"LICENSE","line_end":3,"line_start":3},{"file":"LICENSE","line_end":184,"line_start":184},{"file":"README.md","line_end":20,"line_start":20},{"file":"README.md","line_end":31,"line_start":31},{"file":"README.md","line_end":98,"line_start":98},{"file":"README.md","line_end":111,"line_start":111},{"file":"README.md","line_end":112,"line_start":112},{"file":"README.md","line_end":113,"line_start":113},{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":67,"line_start":67},{"file":"SKILL.md","line_end":84,"line_start":84},{"file":"SKILL.md","line_end":85,"line_start":85},{"file":"SKILL.md","line_end":86,"line_start":86}]},{"factor":"external_commands","evidence":[{"file":"README.md","line_end":21,"line_start":19},{"file":"README.md","line_end":26,"line_start":21},{"file":"README.md","line_end":28,"line_start":26},{"file":"README.md","line_end":36,"line_start":28},{"file":"README.md","line_end":42,"line_start":36},{"file":"README.md","line_end":45,"line_start":42},{"file":"README.md","line_end":47,"line_start":45},{"file":"README.md","line_end":60,"line_start":47},{"file":"README.md","line_end":66,"line_start":60},{"file":"README.md","line_end":69,"line_start":66},{"file":"README.md","line_end":72,"line_start":69},{"file":"README.md","line_end":86,"line_start":72},{"file":"README.md","line_end":87,"line_start":86},{"file":"README.md","line_end":88,"line_start":87},{"file":"README.md","line_end":105,"line_start":88},{"file":"SKILL.md","line_end":17,"line_start":15},{"file":"SKILL.md","line_end":25,"line_start":17},{"file":"SKILL.md","line_end":31,"line_start":25},{"file":"SKILL.md","line_end":38,"line_start":31},{"file":"SKILL.md","line_end":44,"line_start":38},{"file":"SKILL.md","line_end":47,"line_start":44},{"file":"SKILL.md","line_end":55,"line_start":47},{"file":"SKILL.md","line_end":61,"line_start":55},{"file":"SKILL.md","line_end":62,"line_start":61},{"file":"SKILL.md","line_end":63,"line_start":62}]},{"factor":"filesystem","evidence":[{"file":"README.md","line_end":20,"line_start":20},{"file":"README.md","line_end":20,"line_start":20},{"file":"scripts/generate.py","line_end":61,"line_start":61}]},{"factor":"env_access","evidence":[{"file":"scripts/generate.py","line_end":21,"line_start":21},{"file":"scripts/generate.py","line_end":29,"line_start":29},{"file":"scripts/generate.py","line_end":8,"line_start":8},{"file":"scripts/generate.py","line_end":8,"line_start":8},{"file":"scripts/generate.py","line_end":24,"line_start":24},{"file":"scripts/generate.py","line_end":25,"line_start":25},{"file":"scripts/generate.py","line_end":26,"line_start":26},{"file":"scripts/generate.py","line_end":8,"line_start":8},{"file":"scripts/generate.py","line_end":24,"line_start":24},{"file":"scripts/generate.py","line_end":25,"line_start":25},{"file":"scripts/generate.py","line_end":26,"line_start":26},{"file":"scripts/generate.py","line_end":48,"line_start":48}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[{"title":"Hardcoded URL","locations":[{"file":"LICENSE","line_end":3,"line_start":3},{"file":"LICENSE","line_end":184,"line_start":184},{"file":"README.md","line_end":20,"line_start":20},{"file":"README.md","line_end":31,"line_start":31},{"file":"README.md","line_end":98,"line_start":98},{"file":"README.md","line_end":111,"line_start":111},{"file":"README.md","line_end":112,"line_start":112},{"file":"README.md","line_end":113,"line_start":113},{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":67,"line_start":67},{"file":"SKILL.md","line_end":84,"line_start":84},{"file":"SKILL.md","line_end":85,"line_start":85},{"file":"SKILL.md","line_end":86,"line_start":86}],"description":"Hardcoded URL detected in code"},{"title":"Weak cryptographic algorithm","locations":[{"file":"LICENSE","line_end":60,"line_start":60},{"file":"LICENSE","line_end":106,"line_start":106},{"file":"LICENSE","line_end":140,"line_start":140},{"file":"LICENSE","line_end":144,"line_start":144},{"file":"LICENSE","line_end":145,"line_start":145},{"file":"SKILL.md","line_end":3,"line_start":3}],"description":"Weak cryptographic algorithm detected in code"},{"title":"Ruby/shell backtick execution","locations":[{"file":"README.md","line_end":21,"line_start":19},{"file":"README.md","line_end":26,"line_start":21},{"file":"README.md","line_end":28,"line_start":26},{"file":"README.md","line_end":36,"line_start":28},{"file":"README.md","line_end":42,"line_start":36},{"file":"README.md","line_end":45,"line_start":42},{"file":"README.md","line_end":47,"line_start":45},{"file":"README.md","line_end":60,"line_start":47},{"file":"README.md","line_end":66,"line_start":60},{"file":"README.md","line_end":69,"line_start":66},{"file":"README.md","line_end":72,"line_start":69},{"file":"README.md","line_end":86,"line_start":72},{"file":"README.md","line_end":87,"line_start":86},{"file":"README.md","line_end":88,"line_start":87},{"file":"README.md","line_end":105,"line_start":88},{"file":"SKILL.md","line_end":17,"line_start":15},{"file":"SKILL.md","line_end":25,"line_start":17},{"file":"SKILL.md","line_end":31,"line_start":25},{"file":"SKILL.md","line_end":38,"line_start":31},{"file":"SKILL.md","line_end":44,"line_start":38},{"file":"SKILL.md","line_end":47,"line_start":44},{"file":"SKILL.md","line_end":55,"line_start":47},{"file":"SKILL.md","line_end":61,"line_start":55},{"file":"SKILL.md","line_end":62,"line_start":61},{"file":"SKILL.md","line_end":63,"line_start":62}],"description":"Ruby/shell backtick execution detected in code"},{"title":"Hidden file in home directory","locations":[{"file":"README.md","line_end":20,"line_start":20}],"description":"Hidden file in home directory detected in code"},{"title":"Hidden file access","locations":[{"file":"README.md","line_end":20,"line_start":20}],"description":"Hidden file access detected in code"},{"title":"Environment file access","locations":[{"file":"README.md","line_end":38,"line_start":38},{"file":"README.md","line_end":38,"line_start":38},{"file":"README.md","line_end":40,"line_start":40},{"file":"scripts/generate.py","line_end":12,"line_start":12},{"file":"scripts/generate.py","line_end":23,"line_start":23},{"file":"scripts/generate.py","line_end":24,"line_start":24},{"file":"scripts/generate.py","line_end":25,"line_start":25},{"file":"scripts/generate.py","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":27,"line_start":27},{"file":"SKILL.md","line_end":27,"line_start":27}],"description":"Environment file access detected in code"},{"title":"Crypto seed/private key mention","locations":[{"file":"README.md","line_end":40,"line_start":40},{"file":"README.md","line_end":102,"line_start":102},{"file":"SKILL.md","line_end":24,"line_start":24},{"file":"SKILL.md","line_end":77,"line_start":77}],"description":"Crypto seed/private key mention detected in code"},{"title":"Python file write/append","locations":[{"file":"scripts/generate.py","line_end":61,"line_start":61}],"description":"Python file write/append detected in code"},{"title":"Python environment access","locations":[{"file":"scripts/generate.py","line_end":21,"line_start":21},{"file":"scripts/generate.py","line_end":29,"line_start":29}],"description":"Python environment access detected in code"},{"title":"dotenv library","locations":[{"file":"scripts/generate.py","line_end":8,"line_start":8},{"file":"scripts/generate.py","line_end":8,"line_start":8},{"file":"scripts/generate.py","line_end":24,"line_start":24},{"file":"scripts/generate.py","line_end":25,"line_start":25},{"file":"scripts/generate.py","line_end":26,"line_start":26}],"description":"dotenv library detected in code"},{"title":"Python dotenv loader","locations":[{"file":"scripts/generate.py","line_end":8,"line_start":8},{"file":"scripts/generate.py","line_end":24,"line_start":24},{"file":"scripts/generate.py","line_end":25,"line_start":25},{"file":"scripts/generate.py","line_end":26,"line_start":26}],"description":"Python dotenv loader detected in code"},{"title":"Generic API/secret keys","locations":[{"file":"scripts/generate.py","line_end":48,"line_start":48}],"description":"Generic API/secret keys detected in code"},{"title":"Python base64 decode","locations":[{"file":"scripts/generate.py","line_end":62,"line_start":62}],"description":"Python base64 decode detected in code"},{"title":"[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential access","locations":[{"file":"multiple","line_end":1,"line_start":1}],"description":"[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential access detected in code"},{"title":"[HEURISTIC] DANGEROUS COMBINATION: Network + Credentials + Evasion techniques","locations":[{"file":"multiple","line_end":1,"line_start":1}],"description":"[HEURISTIC] DANGEROUS COMBINATION: Network + Credentials + Evasion techniques detected in code"},{"title":"[HEURISTIC] SUSPICIOUS COMBINATION: Filesystem + Credentials + Network","locations":[{"file":"multiple","line_end":1,"line_start":1}],"description":"[HEURISTIC] SUSPICIOUS COMBINATION: Filesystem + Credentials + Network detected in code"}],"files_scanned":5,"total_lines":735,"audit_model":"claude","audited_at":"2026-01-16T18:58:22.136+00:00","created_at":"2026-01-21T01:49:20.919483+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}