Versioned security assessment

Report ID: SA-D7593E66

6/28/2026, 3:55:18 PM

nano-banana-blockrun security assessment v6

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
nano-banana-blockrun
Version
v6
Maintainer
BlockRunAI
Source
github.com/BlockRunAI/nano-banana-blockrun/tree/main/
Coverage
4 Files scanned · 471 Lines analyzed
Policy version
Unavailable

Confirmed finding summary

No confirmed security findings

The completed audit recorded no confirmed security findings. This is not proof that the Skill has no side effects.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static critical heuristics are not confirmed as malicious, and no prompt injection attempt was found. However, the skill requires a wallet private key, loads .env files, signs paid x402 requests, and uses network calls through a third-party SDK. This is high risk for a community marketplace skill and should not be published without stronger review and user warnings.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

4 Files scanned · 471 Lines analyzed

7 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 1 evidence location

Network access

May connect to external services.

Observed in 13 evidence locations

Filesystem access

May read or write local files.

Observed in 2 evidence locations

Env variables

May read values from the process environment.

Observed in 7 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 25 evidence locations

Capability review items (7)
High
SKILL.md:24-30README.md:35-47scripts/generate.py:23-29scripts/generate.py:48
Wallet Private Key Required for Payment Signing
The skill instructs users to place a private wallet key in .env or BLOCKRUN_WALLET_KEY, then passes that key into the BlockRun ImageClient. This is a true positive for credential access because compromise or misuse of this value can authorize crypto payments.
The documentation and script directly require BLOCKRUN_WALLET_KEY and instantiate ImageClient with it. The local-signing claim reduces exfiltration certainty but does not remove the credential handling risk.
High
SKILL.md:67-70README.md:92-98scripts/generate.py:51
Network Payment Flow Uses Third-Party SDK and Signatures
The skill sends generation requests to BlockRun and documents that a payment signature is sent to the server. This is a true positive for network plus credential-adjacent behavior because the workflow spends USDC through signed x402 requests.
The files explicitly describe API calls, HTTP 402 payment handling, local signing, and signature transmission. No evidence proves malicious exfiltration, but the paid network flow is confirmed.
Medium
scripts/generate.py:20-29
Multiple .env Files Are Loaded from Variable Locations
The script loads .env from the requested output directory, current working directory, and skill directory before reading BLOCKRUN_WALLET_KEY. This can unintentionally select a wallet key from a directory chosen by the caller.
The output directory can come from an argument or environment variable, and load_dotenv is called on that path. The behavior is clear, but impact depends on how users run the skill.
Medium
scripts/generate.py:57-63
Generated Files Are Written to Caller-Controlled Paths
The script writes decoded PNG bytes into output_dir using predictable filenames. This is legitimate image generation behavior, but it can overwrite existing generated_image files in the selected directory.
The file write is directly present and uses output_dir. The likely purpose is benign, but the overwrite and path-control behavior remains relevant.
Medium
SKILL.md:4SKILL.md:14-17README.md:25-28
Broad Python and Pip Execution Permissions
The skill metadata allows Bash execution for python, python3, pip, and pip3. This is expected for a script-based skill, but it increases risk because the skill can install packages and execute local Python code.
The allowed-tools declaration and installation commands are explicit. This is not malicious by itself, but it expands the execution surface for a community skill.
Low
README.md:111-113SKILL.md:84-86LICENSE:184
Documented URLs Are Expected Network References
Hardcoded URL findings point to documentation links for Base, BlockRun, PyPI, x402, and the Apache License. These references are expected for setup and attribution.
The URLs are visible documentation links and not hidden endpoints. The actual network risk comes from the SDK request flow, not these links.
Low
scripts/generate.py:55-63
Base64 Decode Used for Image Output
The base64 decode finding is used to save data:image PNG results returned by the image generation API. This appears to be normal handling of image data, not obfuscation.
The code checks for a PNG data URL and writes decoded bytes as an image file. This is a legitimate image-output pattern.

Risk findings

Confirmed security concerns are separated from items that still need review.

No confirmed security findings were recorded for this completed audit.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (2)
Low
README.md:60-72SKILL.md:46-54
Markdown Code Fences Misclassified as Ruby Backticks
The external command findings in README.md and SKILL.md largely point to Markdown fenced examples for installation and usage. They are documentation examples, not Ruby backtick execution in code.
The cited lines are Markdown code blocks and normal shell examples. The static label does not match executable Ruby code.
Low
LICENSE:60LICENSE:106SKILL.md:3
Apache License Text Misclassified as Weak Cryptography
The weak cryptography findings in LICENSE and SKILL.md do not identify cryptographic implementation code. The LICENSE lines are standard Apache License text, and SKILL.md only names the Nano Banana product.
No hashing, encryption, or signature algorithm implementation appears at these locations. The matches are false positives from ordinary license and description text.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable