📦
Audit History
nano-banana-blockrun - 9 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v9 Latest | Jul 23, 2026, 10:21 AM | 9 confirmed | 1 | No capability change |
| v8 | Jul 7, 2026, 08:54 PM | 11 confirmed | 5 | Env variables |
| v7 | Jul 6, 2026, 05:22 AM | 16 confirmed | 14 | Contains scripts |
| v6 | Jun 28, 2026, 03:55 PM | No confirmed findings | 7 | Contains scripts |
| v5 | Jan 16, 2026, 06:58 PM | No confirmed findings | 0 | No capability change |
| v4 | Jan 16, 2026, 06:58 PM | No confirmed findings | 0 | Contains scripts |
| v3 | Jan 10, 2026, 11:30 AM | No confirmed findings | 0 | No capability change |
| v2 | Jan 10, 2026, 11:30 AM | No confirmed findings | 0 | No capability change |
| v1 | Jan 10, 2026, 11:30 AM | No confirmed findings | 0 | Baseline |
Audit version 9 Latest
Jul 23, 2026, 10:21 AM
Most URL, hidden-directory, Git ignore, and Markdown fence detections are benign documentation. Confirmed risks involve plaintext wallet-key handling and transmitting prompts and payment signatures to BlockRun. Additional risks include an unpinned executable dependency with key access and paid requests without approval or spending limits.
5
Files scanned
421
Lines analyzed
13
Review items
0
False positives ignored
Confirmed security concerns (9)
High
Crypto seed/private key mention
# Your EVM wallet private key (with 0x prefix)
The template directs users to provide a raw EVM private key for a wallet holding USDC. Compromise of that plaintext credential can cause financial loss.
High
Environment file access
cp .env.example .env
The setup creates a plaintext .env file that the next instruction populates with a wallet private key. Local exposure of that file can compromise funds.
High
Environment file access
# Edit .env and add your private key
The instruction explicitly tells users to store a wallet private key in .env. This creates a high-impact local secret requiring strong protection.
High
Crypto seed/private key mention
# Edit .env and add your private key
The documented setup requires a raw wallet private key. Theft of this credential permits unauthorized signing and potential loss of wallet funds.
High
Environment file access
# Copy .env.example to .env and add your key
The comment directs users to add a wallet private key to a plaintext .env file. That credential can authorize payments if exposed.
High
Environment file access
cp .env.example .env
The command creates the .env file used for the wallet key. Although legitimate setup, it establishes sensitive plaintext storage.
High
Crypto seed/private key mention
3. Set your wallet private key:
The skill requires users to supply a raw wallet private key to enable paid requests. Credential compromise can lead to unauthorized transactions.
High
Unpinned Dependency Handles Wallet Credentials
The skill installs the latest blockrun-llm package, then runs it while a wallet private key is available. The audited files cannot verify the package's local-signing assurance.
The package command has no version constraint, and the documented client runs with the configured wallet key. No package implementation is present in the audited files.
High
Paid Requests Lack Approval and Spending Limits
The generation flow signs a USDC payment for each request, but the skill requires no per-request approval, request limit, or maximum charge.
The skill documents prices and automatic payment signing, while no approval or spending-control step appears in the workflow.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Low
Hardcoded URL
1. Your request goes to BlockRun API (https://blockrun.ai)
The documented workflow sends user prompts to the BlockRun API and later sends a payment signature. This is expected but real external data transmission.
Risk Factors
🌐 Network access (9)
📁 Filesystem access (2)
⚙️ External commands (10)
Audited by: codex
Jul 7, 2026, 08:54 PM
The audit found no prompt injection text, but the skill has real high-impact secret and payment risks. Several static hits were Markdown or license false positives, while private-key setup, .env usage, external SDK execution, and paid BlockRun API calls remain confirmed concerns.
5
Files scanned
421
Lines analyzed
19
Review items
0
False positives ignored
Confirmed security concerns (11)
High
Crypto seed/private key mention
# Your EVM wallet private key (with 0x prefix)
The template explicitly asks for an EVM wallet private key. No real key is present, but the required setup handles a secret that can authorize spending.
High
Environment file access
cp .env.example .env
The README instructs users to create a .env file for wallet configuration. That file is intended to hold a private key used for payments.
High
Environment file access
# Edit .env and add your private key
The README instructs users to edit .env and add a private key. This creates a local secret file that could be exposed to other tools or agents.
High
Crypto seed/private key mention
# Edit .env and add your private key
The line directly asks the user to add a wallet private key. Compromise of that key can authorize crypto transfers or paid requests.
High
Crypto seed/private key mention
**Your private key NEVER leaves your machine.**
The line is a safety claim, but it confirms the skill depends on handling a wallet private key. The secret-handling risk remains even without evidence of exfiltration.
High
Environment file access
# Copy .env.example to .env and add your key
The setup tells users to copy .env.example to .env and add a wallet key. This creates a local file containing a high-value secret.
High
Environment file access
cp .env.example .env
The command creates the .env file used for wallet credentials. That file may be readable by local tools if permissions are not controlled.
High
Crypto seed/private key mention
3. Set your wallet private key:
The skill requires setting a wallet private key. This is sensitive because the key can authorize payments or asset transfers.
High
Crypto seed/private key mention
**Your private key NEVER leaves your machine.**
The line is a security assurance, but it confirms private-key handling is part of the workflow. The risk is secret exposure or misuse by the SDK or local environment.
High
Autonomous Crypto Spending Risk
The skill can let an AI assistant trigger paid image generation through a wallet-backed x402 flow. Without explicit confirmations or spend limits, repeated requests could consume user funds.
The README says Claude will use the skill automatically, and both README and SKILL.md describe paid signing and image generation. This directly supports the spending-risk assessment.
Medium
Unpinned Payment SDK Installation
The setup installs blockrun-llm without a version pin or hash verification. That package controls image requests and local payment signing, so supply-chain compromise has higher impact.
Both setup sections use pip install blockrun-llm without a version or hash. The same files explain that the SDK signs payment data locally.
Capability review items (5)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Ruby/shell backtick execution · 3 occurrences
```bash
The static label is imprecise, but the fenced block instructs users or agents to run pip install blockrun-llm. Installing an unpinned package is external code execution risk.
Medium
Ruby/shell backtick execution
```python
The Python example imports the external SDK and calls image generation. If executed, it can trigger a network call and a paid request.
Low
Hardcoded URL
1. Your request goes to BlockRun API (https://blockrun.ai)
The skill explicitly routes user image prompts to the BlockRun API. That is intended behavior, but it is real external network disclosure of prompt content and payment metadata.
Risk Factors
🌐 Network access (9)
📁 Filesystem access (2)
⚙️ External commands (10)
Audited by: codex
Jul 6, 2026, 05:22 AM
Confirmed findings center on wallet private-key handling, broad .env loading, external paid network generation, and local image file writes. Markdown code-fence findings were false positives, and the bundled PNG was manually reviewed as benign. No prompt injection attempt was found in the reviewed text files.
4
Files scanned
471
Lines analyzed
34
Review items
0
False positives ignored
Confirmed security concerns (16)
High
Environment file access
cp .env.example .env
The README instructs users to create a .env file for configuration. The surrounding setup stores a wallet private key there, making this sensitive secret handling.
High
Environment file access
# Edit .env and add your private key
The README explicitly tells users to add a private key to .env. Plaintext environment files containing wallet keys are high-risk secret storage.
High
Crypto seed/private key mention
# Edit .env and add your private key
The setup explicitly asks for a wallet private key. Handling a crypto private key creates direct financial-loss risk if mishandled.
High
Crypto seed/private key mention
**Your private key NEVER leaves your machine.**
This line acknowledges that the skill handles a wallet private key. Even with local signing claims, the key remains highly sensitive material used by the skill.
High
Environment file access
# Parse arguments first to get output_dir for .env loading
The comment describes using output_dir for .env loading, which is implemented later in the script. In context, that .env can provide the wallet private key.
High
Environment file access
# Load .env files: output_dir first, then cwd, then skill directory as fallback
The comment documents multiple .env lookup locations before wallet-key use. This confirms sensitive environment-file handling is intentional behavior.
High
Environment file access
load_dotenv(os.path.join(output_dir, '.env'))
The script loads .env from output_dir before checking BLOCKRUN_WALLET_KEY. A user-selected directory controlling secret loading is a high-risk configuration pattern.
High
Environment file access
load_dotenv(os.path.join(os.getcwd(), '.env'))
The script loads .env from the current working directory before reading the wallet key. This can unintentionally consume plaintext secrets from a project directory.
High
Environment file access
load_dotenv(os.path.join(os.path.dirname(__file__), '..', '.env'))
The script loads .env from the skill directory as a fallback. This encourages storing wallet credentials in the installed skill tree.
High
Environment file access
# Copy .env.example to .env and add your key
The setup tells users to put their wallet key into a .env file. This is sensitive plaintext secret storage.
High
Environment file access
cp .env.example .env
The setup copies an example environment file into .env for wallet configuration. The documented purpose is storing a private key.
High
Crypto seed/private key mention
3. Set your wallet private key:
The skill explicitly requires a wallet private key. Crypto private-key handling creates direct asset-loss risk if storage or signing is compromised.
High
Crypto seed/private key mention
**Your private key NEVER leaves your machine.**
This line acknowledges private-key handling by the skill. The local-signing claim does not remove the sensitivity of loading and using the key.
High
User-Selected Directory Controls Wallet Configuration
The script lets output_dir come from arguments or OUTPUT_DIR, then loads .env from that directory before reading BLOCKRUN_WALLET_KEY. A prompt or wrapper that changes the output path could change which wallet key is used.
The code path is direct: output_dir is selected on line 21, .env is loaded from it on line 24, and the wallet key is read on line 29.
Medium
Unpinned Package Installation From PyPI
Setup instructions install blockrun-llm without a pinned version or hash. This increases supply-chain risk because the package handles wallet signing material.
Both setup sections show an unversioned pip install command, and the runtime passes a private key into the installed SDK.
Medium
Paid Generation Can Spend User Funds Without Script Confirmation
The skill presents image generation as an automatic action and the script calls client.generate directly. It does not show a local confirmation step with model price before making a paid request.
The documentation describes pay-per-request usage and the script invokes generation after printing the selected model, with no explicit confirmation gate.
Capability review items (14)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Python environment access
key = os.environ.get("BLOCKRUN_WALLET_KEY")
The script reads BLOCKRUN_WALLET_KEY from the environment. That variable is a crypto wallet private key used for paid requests.
High
dotenv library
load_dotenv(os.path.join(output_dir, '.env'))
The script loads a .env file from output_dir before reading the wallet key. Because output_dir can be user-selected, this is sensitive configuration loading.
High
dotenv library
load_dotenv(os.path.join(os.getcwd(), '.env'))
The script loads .env from the current working directory before reading the wallet key. This can pick up plaintext secrets from local project files.
High
dotenv library
load_dotenv(os.path.join(os.path.dirname(__file__), '..', '.env'))
The script loads .env from the skill directory before reading the wallet key. Storing wallet credentials beside the skill creates sensitive local secret exposure.
High
Python dotenv loader
load_dotenv(os.path.join(output_dir, '.env'))
The loader reads .env from output_dir, which is controlled by an argument or environment variable. This can alter which wallet key the paid request uses.
High
Python dotenv loader
load_dotenv(os.path.join(os.getcwd(), '.env'))
The loader reads a .env file from the current working directory. In this skill, those environment values include a wallet private key.
High
Python dotenv loader
load_dotenv(os.path.join(os.path.dirname(__file__), '..', '.env'))
The loader reads a .env file from the skill directory. This is sensitive because the documented .env value is a crypto wallet private key.
High
Generic API/secret keys
client = ImageClient(private_key=key)
The wallet key is passed into ImageClient as private_key. The skill relies on a third-party SDK to handle sensitive signing material for payments.
Medium
Python file write/append
with open(filename, 'wb') as f:
The script writes generated PNG bytes to output_dir, which can come from an argument or environment variable. This intended behavior is still a filesystem side effect with overwrite and path-placement risk.
Medium
Python environment access
output_dir = sys.argv[3] if len(sys.argv) > 3 else os.environ.get("OUTPUT_DIR", os.getcwd())
The script reads OUTPUT_DIR from the environment, and that value controls both file output and the first .env lookup path. This can affect where secrets are loaded from.
Medium
Hardcoded URL
1. Your request goes to BlockRun API (https://blockrun.ai)
The documentation states requests go to the BlockRun API. That confirms external network transfer for prompts and payment-related signatures.
Low
dotenv library
from dotenv import load_dotenv
The dotenv import enables the later .env loading in this script. In context, that loading is used to configure a wallet private key.
Low
Python dotenv loader
from dotenv import load_dotenv
The python-dotenv loader is imported and used in the same script. Its purpose here is to load wallet-related environment configuration.
Low
Hardcoded URL
- Bridge from Ethereum: https://bridge.base.org
The setup directs users to an external bridge service to obtain funds. This is a user-facing financial network dependency, though it is not hidden behavior.
Risk Factors
🌐 Network access (8)
📁 Filesystem access (3)
🔑 Env variables (11)
⚙️ External commands (10)
Audited by: codex
Jun 28, 2026, 03:55 PM
Static critical heuristics are not confirmed as malicious, and no prompt injection attempt was found. However, the skill requires a wallet private key, loads .env files, signs paid x402 requests, and uses network calls through a third-party SDK. This is high risk for a community marketplace skill and should not be published without stronger review and user warnings.
4
Files scanned
471
Lines analyzed
12
Review items
2
False positives ignored
Capability review items (7)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Wallet Private Key Required for Payment Signing
The skill instructs users to place a private wallet key in .env or BLOCKRUN_WALLET_KEY, then passes that key into the BlockRun ImageClient. This is a true positive for credential access because compromise or misuse of this value can authorize crypto payments.
The documentation and script directly require BLOCKRUN_WALLET_KEY and instantiate ImageClient with it. The local-signing claim reduces exfiltration certainty but does not remove the credential handling risk.
High
Network Payment Flow Uses Third-Party SDK and Signatures
The skill sends generation requests to BlockRun and documents that a payment signature is sent to the server. This is a true positive for network plus credential-adjacent behavior because the workflow spends USDC through signed x402 requests.
The files explicitly describe API calls, HTTP 402 payment handling, local signing, and signature transmission. No evidence proves malicious exfiltration, but the paid network flow is confirmed.
Medium
Multiple .env Files Are Loaded from Variable Locations
The script loads .env from the requested output directory, current working directory, and skill directory before reading BLOCKRUN_WALLET_KEY. This can unintentionally select a wallet key from a directory chosen by the caller.
The output directory can come from an argument or environment variable, and load_dotenv is called on that path. The behavior is clear, but impact depends on how users run the skill.
Medium
Generated Files Are Written to Caller-Controlled Paths
The script writes decoded PNG bytes into output_dir using predictable filenames. This is legitimate image generation behavior, but it can overwrite existing generated_image files in the selected directory.
The file write is directly present and uses output_dir. The likely purpose is benign, but the overwrite and path-control behavior remains relevant.
Medium
Broad Python and Pip Execution Permissions
The skill metadata allows Bash execution for python, python3, pip, and pip3. This is expected for a script-based skill, but it increases risk because the skill can install packages and execute local Python code.
The allowed-tools declaration and installation commands are explicit. This is not malicious by itself, but it expands the execution surface for a community skill.
Low
Documented URLs Are Expected Network References
Hardcoded URL findings point to documentation links for Base, BlockRun, PyPI, x402, and the Apache License. These references are expected for setup and attribution.
The URLs are visible documentation links and not hidden endpoints. The actual network risk comes from the SDK request flow, not these links.
Low
Base64 Decode Used for Image Output
The base64 decode finding is used to save data:image PNG results returned by the image generation API. This appears to be normal handling of image data, not obfuscation.
The code checks for a PNG data URL and writes decoded bytes as an image file. This is a legitimate image-output pattern.
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
Markdown Code Fences Misclassified as Ruby Backticks
The external command findings in README.md and SKILL.md largely point to Markdown fenced examples for installation and usage. They are documentation examples, not Ruby backtick execution in code.
The cited lines are Markdown code blocks and normal shell examples. The static label does not match executable Ruby code.
Low
Apache License Text Misclassified as Weak Cryptography
The weak cryptography findings in LICENSE and SKILL.md do not identify cryptographic implementation code. The LICENSE lines are standard Apache License text, and SKILL.md only names the Nano Banana product.
No hashing, encryption, or signature algorithm implementation appears at these locations. The matches are false positives from ordinary license and description text.
Risk Factors
⚡ Contains scripts (1)
🌐 Network access (13)
⚙️ External commands (25)
README.md:19-21 README.md:21-26 README.md:26-28 README.md:28-36 README.md:36-42 README.md:42-45 README.md:45-47 README.md:47-60 README.md:60-66 README.md:66-69 README.md:69-72 README.md:72-86 README.md:86-87 README.md:87-88 README.md:88-105 SKILL.md:15-17 SKILL.md:17-25 SKILL.md:25-31 SKILL.md:31-38 SKILL.md:38-44 SKILL.md:44-47 SKILL.md:47-55 SKILL.md:55-61 SKILL.md:61-62 SKILL.md:62-63
📁 Filesystem access (3)
Detected Patterns
Credential Access Combined with Paid Network RequestsEnvironment Loading from User-Influenced Directory
Audited by: codex
Jan 16, 2026, 06:58 PM
AI analysis failed after multiple attempts - MANUAL REVIEW REQUIRED before publishing. This skill cannot be auto-published until reviewed by a human.
5
Files scanned
735
Lines analyzed
4
Review items
0
False positives ignored
Risk Factors
🌐 Network access (13)
⚙️ External commands (25)
README.md:19-21 README.md:21-26 README.md:26-28 README.md:28-36 README.md:36-42 README.md:42-45 README.md:45-47 README.md:47-60 README.md:60-66 README.md:66-69 README.md:69-72 README.md:72-86 README.md:86-87 README.md:87-88 README.md:88-105 SKILL.md:15-17 SKILL.md:17-25 SKILL.md:25-31 SKILL.md:31-38 SKILL.md:38-44 SKILL.md:44-47 SKILL.md:47-55 SKILL.md:55-61 SKILL.md:61-62 SKILL.md:62-63
📁 Filesystem access (3)
Detected Patterns
Hardcoded URLWeak cryptographic algorithmRuby/shell backtick executionHidden file in home directoryHidden file accessEnvironment file accessCrypto seed/private key mentionPython file write/appendPython environment accessdotenv libraryPython dotenv loaderGeneric API/secret keysPython base64 decode[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential access[HEURISTIC] DANGEROUS COMBINATION: Network + Credentials + Evasion techniques[HEURISTIC] SUSPICIOUS COMBINATION: Filesystem + Credentials + Network
Audited by: claude
Jan 16, 2026, 06:58 PM
AI analysis failed after multiple attempts - MANUAL REVIEW REQUIRED before publishing. This skill cannot be auto-published until reviewed by a human.
5
Files scanned
735
Lines analyzed
4
Review items
0
False positives ignored
Risk Factors
🌐 Network access (13)
⚙️ External commands (25)
README.md:19-21 README.md:21-26 README.md:26-28 README.md:28-36 README.md:36-42 README.md:42-45 README.md:45-47 README.md:47-60 README.md:60-66 README.md:66-69 README.md:69-72 README.md:72-86 README.md:86-87 README.md:87-88 README.md:88-105 SKILL.md:15-17 SKILL.md:17-25 SKILL.md:25-31 SKILL.md:31-38 SKILL.md:38-44 SKILL.md:44-47 SKILL.md:47-55 SKILL.md:55-61 SKILL.md:61-62 SKILL.md:62-63
📁 Filesystem access (3)
Detected Patterns
Hardcoded URLWeak cryptographic algorithmRuby/shell backtick executionHidden file in home directoryHidden file accessEnvironment file accessCrypto seed/private key mentionPython file write/appendPython environment accessdotenv libraryPython dotenv loaderGeneric API/secret keysPython base64 decode[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential access[HEURISTIC] DANGEROUS COMBINATION: Network + Credentials + Evasion techniques[HEURISTIC] SUSPICIOUS COMBINATION: Filesystem + Credentials + Network
Audited by: claude
Jan 10, 2026, 11:30 AM
Legitimate image generation skill using x402 micropayments. Private keys are used only for local EIP-712 signing with signatures transmitted, not keys. No obfuscation or exfiltration patterns detected.
6
Files scanned
479
Lines analyzed
5
Review items
0
False positives ignored
Risk Factors
⚡ Contains scripts (1)
🌐 Network access (2)
📁 Filesystem access (1)
🔑 Env variables (1)
⚙️ External commands (1)
Audited by: claude
Jan 10, 2026, 11:30 AM
Legitimate image generation skill using x402 micropayments. Private keys are used only for local EIP-712 signing with signatures transmitted, not keys. No obfuscation or exfiltration patterns detected.
6
Files scanned
479
Lines analyzed
5
Review items
0
False positives ignored
Risk Factors
⚡ Contains scripts (1)
🌐 Network access (2)
📁 Filesystem access (1)
🔑 Env variables (1)
⚙️ External commands (1)
Audited by: claude
Jan 10, 2026, 11:30 AM
Legitimate image generation skill using x402 micropayments. Private keys are used only for local EIP-712 signing with signatures transmitted, not keys. No obfuscation or exfiltration patterns detected.
6
Files scanned
479
Lines analyzed
5
Review items
0
False positives ignored
Risk Factors
⚡ Contains scripts (1)
🌐 Network access (2)
📁 Filesystem access (1)
🔑 Env variables (1)
⚙️ External commands (1)
Audited by: claude