Versioned security assessment

Report ID: SA-1B5B6C49

7/7/2026, 8:54:56 PM

nano-banana-blockrun security assessment v8

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
nano-banana-blockrun
Version
v8
Maintainer
BlockRunAI
Source
github.com/BlockRunAI/nano-banana-blockrun/tree/main/
Coverage
5 Files scanned · 421 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

High

11 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The audit found no prompt injection text, but the skill has real high-impact secret and payment risks. Several static hits were Markdown or license false positives, while private-key setup, .env usage, external SDK execution, and paid BlockRun API calls remain confirmed concerns.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

5 Files scanned · 421 Lines analyzed

16 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 9 evidence locations

Filesystem access

May read or write local files.

Observed in 1 evidence location

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 10 evidence locations

Capability review items (5)
Medium
SKILL.md:15-17
Ruby/shell backtick execution
```bash
The static label is imprecise, but the fenced block instructs users or agents to run pip install blockrun-llm. Installing an unpinned package is external code execution risk.
Medium
SKILL.md:25-31
Ruby/shell backtick execution
```bash
The fenced shell block includes commands to create .env and export BLOCKRUN_WALLET_KEY. The commands are simple, but they operationalize sensitive wallet-key handling.
Medium
SKILL.md:38-44
Ruby/shell backtick execution
```python
The Python example imports the external SDK and calls image generation. If executed, it can trigger a network call and a paid request.
Medium
SKILL.md:47-55
Ruby/shell backtick execution
```bash
The fenced shell block tells users to run python scripts/generate.py. The referenced script is not present in the scanned files, so the execution path cannot be verified.
Low
SKILL.md:67
Hardcoded URL
1. Your request goes to BlockRun API (https://blockrun.ai)
The skill explicitly routes user image prompts to the BlockRun API. That is intended behavior, but it is real external network disclosure of prompt content and payment metadata.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (11)

RISK-001 High
.env.example:2
Crypto seed/private key mention
# Your EVM wallet private key (with 0x prefix)
The template explicitly asks for an EVM wallet private key. No real key is present, but the required setup handles a secret that can authorize spending.
RISK-002 High
README.md:38
Environment file access
cp .env.example .env
The README instructs users to create a .env file for wallet configuration. That file is intended to hold a private key used for payments.
RISK-003 High
README.md:40
Environment file access
# Edit .env and add your private key
The README instructs users to edit .env and add a private key. This creates a local secret file that could be exposed to other tools or agents.
RISK-004 High
README.md:40
Crypto seed/private key mention
# Edit .env and add your private key
The line directly asks the user to add a wallet private key. Compromise of that key can authorize crypto transfers or paid requests.
RISK-005 High
README.md:102
Crypto seed/private key mention
**Your private key NEVER leaves your machine.**
The line is a safety claim, but it confirms the skill depends on handling a wallet private key. The secret-handling risk remains even without evidence of exfiltration.
RISK-006 High
SKILL.md:26
Environment file access
# Copy .env.example to .env and add your key
The setup tells users to copy .env.example to .env and add a wallet key. This creates a local file containing a high-value secret.
RISK-007 High
SKILL.md:27
Environment file access
cp .env.example .env
The command creates the .env file used for wallet credentials. That file may be readable by local tools if permissions are not controlled.
RISK-008 High
SKILL.md:24
Crypto seed/private key mention
3. Set your wallet private key:
The skill requires setting a wallet private key. This is sensitive because the key can authorize payments or asset transfers.
RISK-009 High
SKILL.md:77
Crypto seed/private key mention
**Your private key NEVER leaves your machine.**
The line is a security assurance, but it confirms private-key handling is part of the workflow. The risk is secret exposure or misuse by the SDK or local environment.
RISK-010 High
README.md:53-56README.md:92-96SKILL.md:67-70
Autonomous Crypto Spending Risk
The skill can let an AI assistant trigger paid image generation through a wallet-backed x402 flow. Without explicit confirmations or spend limits, repeated requests could consume user funds.
The README says Claude will use the skill automatically, and both README and SKILL.md describe paid signing and image generation. This directly supports the spending-risk assessment.
RISK-011 Medium
README.md:25-28SKILL.md:14-17
Unpinned Payment SDK Installation
The setup installs blockrun-llm without a version pin or hash verification. That package controls image requests and local payment signing, so supply-chain compromise has higher impact.
Both setup sections use pip install blockrun-llm without a version or hash. The same files explain that the SDK signs payment data locally.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    The skill requires users to configure a raw wallet private key.
    Support a safer wallet flow, hardware signing, delegated keys, or a dedicated low-balance wallet with documented spend limits.
  2. FIX-002
    High
    Paid image generation can be triggered through natural language requests.
    Require explicit user confirmation before each paid request and display model, price, network, and wallet balance impact.
  3. FIX-003
    Medium
    The setup installs blockrun-llm without pinning or verification.
    Pin a reviewed package version and document hash verification or a trusted lockfile for the payment SDK.
  4. FIX-004
    Low
    The documentation references scripts/generate.py, but the script is absent from scanned files.
    Add the referenced script or remove the command examples so users do not run unverifiable paths.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable