📦
История аудитов
nanobanana - 4 аудиты
Сравнение версий
Изменения возможностей и находок между проверенными версиями, сначала новые.
| Версия | Дата | Результат | Пункты проверки | Изменение к предыдущей |
|---|---|---|---|---|
| v4 Последняя | 2026년 7월 5일 오전 04:39 | 4 подтверждено | 0 | Возможности не изменились |
| v3 | 2026년 7월 5일 오전 04:39 | 4 подтверждено | 0 | Содержит скрипты |
| v2 | 2026년 6월 28일 오후 01:39 | 4 подтверждено | 1 | Содержит скриптыДоступ к сетиДоступ к файловой системеПеременные окруженияВнешние команды |
| v1 | 2026년 5월 4일 오전 09:53 | Подтверждённых находок нет | 0 | Базовая |
Версия аудита 4 Последняя
2026년 7월 5일 오전 04:39
Most static findings are Markdown examples, placeholder environment variable names, or safe wrapper behavior. One critical pipe-to-shell installer was confirmed, and semantic review found runtime dependency, file selection, and secret storage risks.
7
Просканировано файлов
809
Проанализировано строк
8
Пункты проверки
0
Ложные срабатывания проигнорированы
Подтверждённые проблемы безопасности (4)
Критично
Pipe to shell pattern
- [`uv`](https://docs.astral.sh/uv/getting-started/installation/) on `PATH` (one-line install: `curl
README.md line 24 recommends piping a remote installer into sh. This executes unaudited network content in the user shell.
Средний
Runtime Dependency Fetch Without Lockfile
The script runs through uv run --script and declares google-genai>=1.0.0 without a lockfile. First use can fetch newer package code from the network.
The shebang and PEP 723 metadata directly show uv runtime dependency resolution. No pinned version or lockfile evidence was found.
Средний
Broad Local File Search Before Upload
Edit and restore commands search cwd, images, input, output, Downloads, and Desktop. The selected image bytes are then sent to the Gemini model.
The code lists home-directory search paths and reads the selected file into the model request. This is intended behavior but can expose the wrong local image.
Средний
Plaintext Shell-Wide Secret Storage Guidance
The README recommends appending an API key to ~/.zshenv and notes that the file loads for every zsh invocation. This broadens secret exposure.
The setup instructions explicitly place a placeholder API key in shell or Claude settings files. The README itself notes plain text storage.
Факторы риска
🌐 Доступ к сети (3)
📁 Доступ к файловой системе (16)
🔑 Переменные окружения (27)
README.md:42 README.md:55 README.md:65 README.md:66 README.md:67 README.md:68 README.md:69 references/troubleshooting.md:7 references/troubleshooting.md:8 references/troubleshooting.md:9 references/troubleshooting.md:10 references/troubleshooting.md:11 scripts/nanobanana.py:57 scripts/nanobanana.py:72 scripts/nanobanana.py:29 scripts/nanobanana.py:30 scripts/nanobanana.py:31 scripts/nanobanana.py:32 scripts/nanobanana.py:33 scripts/nanobanana.py:34 scripts/nanobanana.py:55 scripts/nanobanana.py:56 scripts/nanobanana.py:61 scripts/nanobanana.py:62 scripts/nanobanana.py:68 SKILL.md:3 SKILL.md:14
⚙️ Внешние команды (23)
scripts/nanobanana.py:118 scripts/nanobanana.py:10 scripts/nanobanana.py:11 SKILL.md:9 SKILL.md:13 SKILL.md:14 SKILL.md:22 SKILL.md:23 SKILL.md:24 SKILL.md:25 SKILL.md:26 SKILL.md:27 SKILL.md:28 SKILL.md:30 SKILL.md:36-38 SKILL.md:38-40 SKILL.md:40-44 SKILL.md:44-46 SKILL.md:46 SKILL.md:53 SKILL.md:54-55 SKILL.md:55-59 SKILL.md:59-79
Обнаруженные паттерны
Pipe to shell pattern
Аудитор:: codex
2026년 7월 5일 오전 04:39
Most static findings are Markdown examples, placeholder environment variable names, or safe wrapper behavior. One critical pipe-to-shell installer was confirmed, and semantic review found runtime dependency, file selection, and secret storage risks.
7
Просканировано файлов
809
Проанализировано строк
8
Пункты проверки
0
Ложные срабатывания проигнорированы
Подтверждённые проблемы безопасности (4)
Критично
Pipe to shell pattern
- [`uv`](https://docs.astral.sh/uv/getting-started/installation/) on `PATH` (one-line install: `curl
README.md line 24 recommends piping a remote installer into sh. This executes unaudited network content in the user shell.
Средний
Runtime Dependency Fetch Without Lockfile
The script runs through uv run --script and declares google-genai>=1.0.0 without a lockfile. First use can fetch newer package code from the network.
The shebang and PEP 723 metadata directly show uv runtime dependency resolution. No pinned version or lockfile evidence was found.
Средний
Broad Local File Search Before Upload
Edit and restore commands search cwd, images, input, output, Downloads, and Desktop. The selected image bytes are then sent to the Gemini model.
The code lists home-directory search paths and reads the selected file into the model request. This is intended behavior but can expose the wrong local image.
Средний
Plaintext Shell-Wide Secret Storage Guidance
The README recommends appending an API key to ~/.zshenv and notes that the file loads for every zsh invocation. This broadens secret exposure.
The setup instructions explicitly place a placeholder API key in shell or Claude settings files. The README itself notes plain text storage.
Факторы риска
🌐 Доступ к сети (3)
📁 Доступ к файловой системе (16)
🔑 Переменные окружения (27)
README.md:42 README.md:55 README.md:65 README.md:66 README.md:67 README.md:68 README.md:69 references/troubleshooting.md:7 references/troubleshooting.md:8 references/troubleshooting.md:9 references/troubleshooting.md:10 references/troubleshooting.md:11 scripts/nanobanana.py:57 scripts/nanobanana.py:72 scripts/nanobanana.py:29 scripts/nanobanana.py:30 scripts/nanobanana.py:31 scripts/nanobanana.py:32 scripts/nanobanana.py:33 scripts/nanobanana.py:34 scripts/nanobanana.py:55 scripts/nanobanana.py:56 scripts/nanobanana.py:61 scripts/nanobanana.py:62 scripts/nanobanana.py:68 SKILL.md:3 SKILL.md:14
⚙️ Внешние команды (23)
scripts/nanobanana.py:118 scripts/nanobanana.py:10 scripts/nanobanana.py:11 SKILL.md:9 SKILL.md:13 SKILL.md:14 SKILL.md:22 SKILL.md:23 SKILL.md:24 SKILL.md:25 SKILL.md:26 SKILL.md:27 SKILL.md:28 SKILL.md:30 SKILL.md:36-38 SKILL.md:38-40 SKILL.md:40-44 SKILL.md:44-46 SKILL.md:46 SKILL.md:53 SKILL.md:54-55 SKILL.md:55-59 SKILL.md:59-79
Обнаруженные паттерны
Pipe to shell pattern
Аудитор:: codex
2026년 6월 28일 오후 01:39
Static analysis reported many severe patterns, but manual review shows no confirmed malicious intent and no prompt injection attempts. The main real risks are expected for this skill type: environment API key access, external Gemini API calls, local image file reads for edit and restore, automatic dependency bootstrap, and a documented pipe-to-shell uv installer command.
7
Просканировано файлов
809
Проанализировано строк
10
Пункты проверки
1
Ложные срабатывания проигнорированы
Подтверждённые проблемы безопасности (4)
Средний
External Gemini API Use With Environment API Key
The skill intentionally reads Gemini API keys from environment variables and sends prompts, and sometimes image bytes, to the Gemini API. This is expected for image generation, but users must understand that prompt and image content leave the local machine.
The script directly obtains API keys from environment variables and creates a genai.Client. The model call passes prompt content and optional image bytes to the external Gemini service.
Средний
Local Image File Reads Can Upload User Files
The edit and restore flows resolve image filenames from the current directory, common subdirectories, Downloads, Desktop, or absolute paths, then read the file bytes for the model request. This is legitimate for image editing but can expose local image contents if a user selects the wrong file.
The file search and read paths are explicit and are used by image edit and restore operations. The behavior is expected, but the privacy risk is real when images are sent to a remote model.
Средний
Supply Chain Exposure From Installer and Runtime Dependency Bootstrap
The README recommends installing uv through a downloaded shell script, and the skill script relies on uv inline metadata to provision google-genai automatically. This is not malicious, but it adds supply chain trust requirements outside the skill repository.
The pipe-to-shell command and automatic dependency provisioning are visible in the documentation and script header. These are common installation patterns, but users must trust the upstream installer and package source.
Низкий
Subprocess Preview Command Is Constrained
Static analysis flagged subprocess.Popen, but the command is selected from fixed platform preview commands and receives the generated path as a separate argument. I did not find evidence of shell=True or user-controlled command construction.
The subprocess call uses fixed command arrays for open, cmd start, or xdg-open. The path can vary, but it is not interpolated into a shell command.
Пункты проверки возможностей (1)
Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.
Низкий
Base64 Decode Handles Gemini Image Response Data
The base64 decode finding appears to be a safe response parsing pattern. It decodes inline image data returned by the Gemini SDK and writes the resulting bytes as image files.
The decoded bytes come from image response parts and are saved as generated output. I did not find evidence of decoded code execution or hidden payload loading.
Статические ложные срабатывания проигнорированы (1)
Эти статические совпадения были отклонены семантической проверкой или совпадали только со схемными токенами, поэтому они показываются для прозрачности, но не влияют на оценку качества.
Низкий
Markdown Command and Weak Crypto Alerts Are Mostly False Positives
Many Ruby backtick, weak cryptography, hidden home file, and hardcoded URL alerts are markdown examples, model names, prompt placeholders, or documentation paths. I did not find evidence that these markdown lines perform code execution or cryptographic operations at runtime.
The cited locations are markdown tables, fenced examples, environment variable lists, or model labels. The only runtime code reviewed is the Python script, where these specific markdown patterns are not executed.
Факторы риска
⚡ Содержит скрипты (2)
🌐 Доступ к сети (4)
📁 Доступ к файловой системе (4)
🔑 Переменные окружения (4)
⚙️ Внешние команды (3)
Обнаруженные паттерны
External Gemini API Use With Environment API KeyLocal Image File Reads Can Upload User FilesSupply Chain Exposure From Installer and Runtime Dependency BootstrapSubprocess Preview Command Is Constrained
Аудитор:: codex
2026년 5월 4일 오전 09:53
Static analysis detected 216 potential issues but manual evaluation confirms all are false positives. The skill is a legitimate image generation tool using Google's Gemini API. Network calls go exclusively to Google's official API endpoints. Environment variable access is standard API key configuration. Subprocess usage is limited to safe desktop integration (image preview). Base64 decoding handles image data from API responses. No credential exfiltration, data leakage, or malicious behavior detected.
10
Просканировано файлов
846
Проанализировано строк
0
Пункты проверки
0
Ложные срабатывания проигнорированы
В этом завершенном аудите не зафиксировано подтвержденных проблем безопасности.
Аудитор:: claude