📦
Audit History
nano-banana-edit - 6 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v6 Latest | Jul 23, 2026, 09:11 AM | 2 confirmed | 3 | No capability change |
| v5 | Jul 8, 2026, 12:23 AM | 1 confirmed | 10 | No capability change |
| v4 | Jul 5, 2026, 01:03 AM | No confirmed findings | 9 | No capability change |
| v3 | Jul 5, 2026, 01:03 AM | No confirmed findings | 9 | No capability change |
| v2 | Jun 28, 2026, 06:17 AM | No confirmed findings | 3 | No capability change |
| v1 | May 6, 2026, 08:59 AM | No confirmed findings | 0 | Baseline |
Audit version 6 Latest
Jul 23, 2026, 09:11 AM
Most flags are false positives caused by Markdown backticks, placeholder URLs, and a documented token path. The skill still recommends unpinned package execution and sends prompts and image references to RunComfy. Its shell examples do not adequately protect generated user text from shell quoting failures.
1
Files scanned
186
Lines analyzed
8
Review items
0
False positives ignored
Confirmed security concerns (2)
High
Unsafe Shell Boundary for Generated Prompt JSON
The examples place JSON inside a single-quoted shell argument, while the skill states that user prompts enter this argument. CLI-side non-expansion cannot stop shell parsing before the CLI starts.
The documented Bash form has a real quoting boundary, and line 182 confirms user prompt data reaches that argument. Exploitation depends on how the agent constructs and launches the command.
Medium
Third-Party Prompt and Image Disclosure
RunComfy receives the edit prompt and fetches user-provided image URLs. Sensitive images, signed URLs, and prompt content therefore leave the local environment.
The skill explicitly documents public input URLs, API submission, server-side fetching, and outbound service domains.
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Ruby/shell backtick execution
```bash
The fenced block contains an unpinned npx command that can download and execute npm code while installing a community skill globally.
Medium
Ruby/shell backtick execution
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`
The prerequisite directs users to install an unpinned npm package globally. Package installation can execute lifecycle code with the user's privileges.
Low
Hardcoded URL
The skill invokes `runcomfy run google/nano-banana-2/edit` with a JSON body matching the schema. The
The paragraph explicitly states that the CLI posts requests to the RunComfy API, polls results, and downloads generated files. This is expected functionality but real outbound network activity.
Risk Factors
⚙️ External commands (36)
SKILL.md:10 SKILL.md:23-25 SKILL.md:25-42 SKILL.md:42-43 SKILL.md:43-44 SKILL.md:44 SKILL.md:48-52 SKILL.md:52-53 SKILL.md:53-54 SKILL.md:54-55 SKILL.md:55-56 SKILL.md:56 SKILL.md:57 SKILL.md:58 SKILL.md:59-60 SKILL.md:60-61 SKILL.md:61-67 SKILL.md:67-74 SKILL.md:74-78 SKILL.md:78-87 SKILL.md:87-91 SKILL.md:91-98 SKILL.md:98-102 SKILL.md:102-106 SKILL.md:106 SKILL.md:125-132 SKILL.md:132-135 SKILL.md:135-139 SKILL.md:139-143 SKILL.md:143-147 SKILL.md:147-152 SKILL.md:152-177 SKILL.md:177 SKILL.md:181 SKILL.md:182-184 SKILL.md:184
🌐 Network access (7)
📁 Filesystem access (5)
Audited by: codex
Jul 8, 2026, 12:23 AM
Most static findings are false positives caused by Markdown backticks, example URLs, and abbreviated URL placeholders. Confirmed risks include RunComfy CLI execution, global CLI installation, third-party API processing, output downloads, and login side effects. No prompt injection attempt was found.
1
Files scanned
186
Lines analyzed
14
Review items
0
False positives ignored
Confirmed security concerns (1)
Medium
Third-Party Image and Prompt Processing
The skill sends edit prompts and image URL references to the RunComfy model API, and RunComfy fetches user-provided media URLs. Users can expose private creative assets if they provide confidential URLs or prompts.
Lines 177-184 describe posting to RunComfy, downloading outputs, and remote fetching of image URLs. The behavior is disclosed and expected, so this is a privacy risk rather than evidence of malicious exfiltration.
Capability review items (10)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Ruby/shell backtick execution
Calls `runcomfy run google/nano-banana-2/edit` through the local
The skill states it calls the local RunComfy CLI, which is intentional external command execution on the user machine. The command name is fixed, but users must trust the installed CLI and its network behavior.
Medium
Ruby/shell backtick execution · 4 occurrences
```bash
The bash block instructs users to run a global skill installation command from a community GitHub source. This is documented setup guidance, but it is still a real supply-chain and external-command exposure.
Medium
Ruby/shell backtick execution
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`
The prerequisite asks users to install the RunComfy CLI globally through npm. Installing and later executing a global CLI is a real external-command and package trust risk.
Medium
Ruby/shell backtick execution
2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.
The prerequisite asks users to execute runcomfy login, which starts an authentication flow and changes local credential state. This is expected for the service but remains a real command with security impact.
Medium
Ruby/shell backtick execution
The skill invokes `runcomfy run google/nano-banana-2/edit` with a JSON body matching the schema. The
The how-it-works section confirms the skill invokes runcomfy, posts to model-api.runcomfy.net, polls, fetches results, and downloads output. This is intentional external command, network, and file-write behavior.
Medium
Ruby/shell backtick execution
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m
The security section documents running runcomfy login and persisting an API token. This is expected CLI behavior, but it is still a command with credential side effects.
Medium
Hardcoded URL
The skill invokes `runcomfy run google/nano-banana-2/edit` with a JSON body matching the schema. The
The skill documents posting requests to the RunComfy model API and downloading generated outputs from RunComfy domains. This expected service behavior still transfers user edit data to a third party.
Risk Factors
⚙️ External commands (36)
SKILL.md:10 SKILL.md:23-25 SKILL.md:25-42 SKILL.md:42-43 SKILL.md:43-44 SKILL.md:44 SKILL.md:48-52 SKILL.md:52-53 SKILL.md:53-54 SKILL.md:54-55 SKILL.md:55-56 SKILL.md:56 SKILL.md:57 SKILL.md:58 SKILL.md:59-60 SKILL.md:60-61 SKILL.md:61-67 SKILL.md:67-74 SKILL.md:74-78 SKILL.md:78-87 SKILL.md:87-91 SKILL.md:91-98 SKILL.md:98-102 SKILL.md:102-106 SKILL.md:106 SKILL.md:125-132 SKILL.md:132-135 SKILL.md:135-139 SKILL.md:139-143 SKILL.md:143-147 SKILL.md:147-152 SKILL.md:152-177 SKILL.md:177 SKILL.md:181 SKILL.md:182-184 SKILL.md:184
🌐 Network access (7)
📁 Filesystem access (5)
Audited by: codex
Jul 5, 2026, 01:03 AM
Most static findings are Markdown backtick false positives from documentation tables, prompt examples, and code fences. Confirmed risks are intended CLI execution, global package installation, authentication setup, and RunComfy API submission. No prompt-injection text, hidden-file abuse, or path traversal evidence was found in SKILL.md.
1
Files scanned
186
Lines analyzed
12
Review items
0
False positives ignored
Capability review items (9)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Ruby/shell backtick execution
Calls `runcomfy run google/nano-banana-2/edit` through the local
This line declares that the skill calls the local RunComfy CLI to invoke a remote image-edit model. That is intentional external command execution and can submit user prompts and image URLs to a third-party service.
Medium
Ruby/shell backtick execution · 4 occurrences
```bash
The fenced command shows an npx-based global skill installation from a community GitHub source. It is expected setup guidance, but it is still external command execution with supply-chain exposure.
Medium
Ruby/shell backtick execution
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`
The prerequisite instructs installing the RunComfy CLI globally with npm. Installing and executing a global package is a real external-command and supply-chain risk, even if it is required for the skill.
Medium
Ruby/shell backtick execution
2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.
The skill instructs users to run RunComfy authentication through the CLI. This is legitimate setup, but it creates local credential state and contacts an external service.
Medium
Ruby/shell backtick execution
The skill invokes `runcomfy run google/nano-banana-2/edit` with a JSON body matching the schema. The
This line describes the actual runcomfy command path, remote POST, polling, and output download flow. The behavior is expected, but it confirms external command execution with network transfer and local file writes.
Low
Hardcoded URL
The skill invokes `runcomfy run google/nano-banana-2/edit` with a JSON body matching the schema. The
This line names the RunComfy model API endpoint used to submit requests and download generated outputs. The endpoint is disclosed and expected, but prompts and image URLs leave the local environment.
Risk Factors
⚙️ External commands (36)
SKILL.md:10 SKILL.md:23-25 SKILL.md:25-42 SKILL.md:42-43 SKILL.md:43-44 SKILL.md:44 SKILL.md:48-52 SKILL.md:52-53 SKILL.md:53-54 SKILL.md:54-55 SKILL.md:55-56 SKILL.md:56 SKILL.md:57 SKILL.md:58 SKILL.md:59-60 SKILL.md:60-61 SKILL.md:61-67 SKILL.md:67-74 SKILL.md:74-78 SKILL.md:78-87 SKILL.md:87-91 SKILL.md:91-98 SKILL.md:98-102 SKILL.md:102-106 SKILL.md:106 SKILL.md:125-132 SKILL.md:132-135 SKILL.md:135-139 SKILL.md:139-143 SKILL.md:143-147 SKILL.md:147-152 SKILL.md:152-177 SKILL.md:177 SKILL.md:181 SKILL.md:182-184 SKILL.md:184
🌐 Network access (7)
📁 Filesystem access (5)
Audited by: codex
Jul 5, 2026, 01:03 AM
Most static findings are Markdown backtick false positives from documentation tables, prompt examples, and code fences. Confirmed risks are intended CLI execution, global package installation, authentication setup, and RunComfy API submission. No prompt-injection text, hidden-file abuse, or path traversal evidence was found in SKILL.md.
1
Files scanned
186
Lines analyzed
12
Review items
0
False positives ignored
Capability review items (9)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Ruby/shell backtick execution
Calls `runcomfy run google/nano-banana-2/edit` through the local
This line declares that the skill calls the local RunComfy CLI to invoke a remote image-edit model. That is intentional external command execution and can submit user prompts and image URLs to a third-party service.
Medium
Ruby/shell backtick execution · 4 occurrences
```bash
The fenced command shows an npx-based global skill installation from a community GitHub source. It is expected setup guidance, but it is still external command execution with supply-chain exposure.
Medium
Ruby/shell backtick execution
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`
The prerequisite instructs installing the RunComfy CLI globally with npm. Installing and executing a global package is a real external-command and supply-chain risk, even if it is required for the skill.
Medium
Ruby/shell backtick execution
2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.
The skill instructs users to run RunComfy authentication through the CLI. This is legitimate setup, but it creates local credential state and contacts an external service.
Medium
Ruby/shell backtick execution
The skill invokes `runcomfy run google/nano-banana-2/edit` with a JSON body matching the schema. The
This line describes the actual runcomfy command path, remote POST, polling, and output download flow. The behavior is expected, but it confirms external command execution with network transfer and local file writes.
Low
Hardcoded URL
The skill invokes `runcomfy run google/nano-banana-2/edit` with a JSON body matching the schema. The
This line names the RunComfy model API endpoint used to submit requests and download generated outputs. The endpoint is disclosed and expected, but prompts and image URLs leave the local environment.
Risk Factors
⚙️ External commands (36)
SKILL.md:10 SKILL.md:23-25 SKILL.md:25-42 SKILL.md:42-43 SKILL.md:43-44 SKILL.md:44 SKILL.md:48-52 SKILL.md:52-53 SKILL.md:53-54 SKILL.md:54-55 SKILL.md:55-56 SKILL.md:56 SKILL.md:57 SKILL.md:58 SKILL.md:59-60 SKILL.md:60-61 SKILL.md:61-67 SKILL.md:67-74 SKILL.md:74-78 SKILL.md:78-87 SKILL.md:87-91 SKILL.md:91-98 SKILL.md:98-102 SKILL.md:102-106 SKILL.md:106 SKILL.md:125-132 SKILL.md:132-135 SKILL.md:135-139 SKILL.md:139-143 SKILL.md:143-147 SKILL.md:147-152 SKILL.md:152-177 SKILL.md:177 SKILL.md:181 SKILL.md:182-184 SKILL.md:184
🌐 Network access (7)
📁 Filesystem access (5)
Audited by: codex
Jun 28, 2026, 06:17 AM
Static analysis heavily over-counted Markdown backticks and examples as executable Ruby shell syntax, so most command findings are false positives. The skill still intentionally uses the RunComfy CLI, sends prompts and image URLs to RunComfy over HTTPS, and writes outputs or tokens locally, so publication should include a medium-risk warning. No evidence of malware, prompt injection, credential exfiltration, or hidden execution was found in SKILL.md.
1
Files scanned
186
Lines analyzed
6
Review items
1
False positives ignored
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Third-Party Image Processing Through RunComfy
The skill directs users to send prompts and image URLs to the RunComfy Model API through the local RunComfy CLI. This is expected behavior for the skill, but user images, prompts, and generated outputs leave the local environment and should be treated as third-party processing.
The network behavior is explicitly documented, including the API endpoint and output download domains. It appears intentional rather than malicious, but it materially affects user privacy.
Medium
External CLI Invocation Required
The skill requires installing and running the RunComfy CLI, including commands for login and model execution. This is core functionality, but external command execution increases supply-chain and local execution risk compared with a pure documentation skill.
The referenced commands are clear and legitimate for RunComfy usage. Risk remains because the workflow depends on installing and executing third-party CLI software.
Low
Local Token Storage Documented
The skill explains that RunComfy login stores an API token under the user configuration directory with owner-only permissions. This is not hidden malicious access, but users should understand where credentials are stored and may prefer RUNCOMFY_TOKEN in isolated environments.
The file path and permission mode are documented directly in the security section. The text describes normal CLI credential storage rather than unauthorized access.
Static false positives ignored (1)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
Static Path Traversal and Weak Crypto Findings Dismissed
The path traversal findings are caused by placeholder HTTPS image URLs containing ellipses, and the weak cryptography findings appear to match model naming or headings rather than cryptographic code. No executable path traversal, cryptographic implementation, or system reconnaissance logic was found.
Manual review found documentation, placeholders, and exit-code tables at the flagged locations. There is no code that traverses local paths or implements weak cryptography.
Risk Factors
⚙️ External commands (4)
🌐 Network access (5)
📁 Filesystem access (4)
Detected Patterns
Networked External Command Workflow
Audited by: codex
May 6, 2026, 08:59 AM
All static findings are false positives. The skill is a documentation wrapper that calls the RunComfy CLI to invoke the Google Nano Banana 2 image-to-image edit endpoint. Commands shown in documentation (SKILL.md) are markdown code blocks, not actual shell execution. The CLI passes user prompts as JSON via the --input flag, not via shell string interpolation, eliminating command injection risk. The skill properly documents its security architecture including token storage, input boundary handling, and network endpoints.
1
Files scanned
186
Lines analyzed
3
Review items
0
False positives ignored
Risk Factors
⚙️ External commands (5)
🌐 Network access (4)
📁 Filesystem access (4)
Audited by: claude