Audit History

SKILL.md:23-25 SKILL.md:67-74 SKILL.md:78-87 SKILL.md:91-98

Ruby/shell backtick execution

Calls `runcomfy run google/nano-banana-2/edit` through the local

Line 10 states that the skill calls the local RunComfy CLI for image editing. This is intentional external command execution that can submit user content and download outputs.

Medium

Ruby/shell backtick execution · 4 occurrences

```bash

The fenced install example includes an npx command that installs a GitHub-hosted skill globally. It is user-initiated documentation, but it still asks users to run an external package command.

Medium

Ruby/shell backtick execution

1. **RunComfy CLI** — `npm i -g @runcomfy/cli`

Line 42 instructs users to install the RunComfy CLI with npm. Installing and later running a global CLI is a real external command dependency.

Medium

Ruby/shell backtick execution

2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.

Line 43 instructs users to run RunComfy login. This is a legitimate authentication step, but it invokes an external CLI and creates local credential state.

Medium

Ruby/shell backtick execution

The skill invokes `runcomfy run google/nano-banana-2/edit` with a JSON body matching the schema. The

Line 177 describes the CLI posting to the RunComfy model API and downloading generated outputs. This confirms the skill depends on local command execution and outbound processing.

Low

SKILL.md:53 SKILL.md:177-183

Hardcoded URL

The skill invokes `runcomfy run google/nano-banana-2/edit` with a JSON body matching the schema. The

Line 177 documents the concrete RunComfy API endpoint and output download domains used by the CLI. This is intended network behavior, but it is real outbound connectivity.

Audited by: codex

Audit version 5

Jul 9, 2026, 11:23 AM

The skill is a Markdown guide for using RunComfy Nano Banana 2 Edit through a local CLI. Most static findings are Markdown formatting, placeholder URLs, or transparent security notes; the real risks are intentional external CLI execution and third-party image processing. No prompt injection attempt or malicious exfiltration instruction was found.

1

Files scanned

186

Lines analyzed

13

Review items

0

False positives ignored

Confirmed security concerns (1)

Medium

Third-party image and prompt processing

The skill sends prompts and user-provided image URLs to the RunComfy model API, and the model server fetches those external images. Users should treat sensitive images and private URLs as data shared with a third party.

The schema requires publicly fetchable HTTPS image URLs, and the documentation states that the CLI posts to RunComfy and that image URLs are fetched by the model server.

Capability review items (9)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:23-25 SKILL.md:67-74 SKILL.md:78-87 SKILL.md:91-98

Ruby/shell backtick execution

Calls `runcomfy run google/nano-banana-2/edit` through the local

Line 10 states that the skill calls the local RunComfy CLI for image editing. This is intentional external command execution that can submit user content and download outputs.

Medium

Ruby/shell backtick execution · 4 occurrences

```bash

The fenced install example includes an npx command that installs a GitHub-hosted skill globally. It is user-initiated documentation, but it still asks users to run an external package command.

Medium

Ruby/shell backtick execution

1. **RunComfy CLI** — `npm i -g @runcomfy/cli`

Line 42 instructs users to install the RunComfy CLI with npm. Installing and later running a global CLI is a real external command dependency.

Medium

Ruby/shell backtick execution

2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.

Line 43 instructs users to run RunComfy login. This is a legitimate authentication step, but it invokes an external CLI and creates local credential state.

Medium

Ruby/shell backtick execution

The skill invokes `runcomfy run google/nano-banana-2/edit` with a JSON body matching the schema. The

Line 177 describes the CLI posting to the RunComfy model API and downloading generated outputs. This confirms the skill depends on local command execution and outbound processing.

Low

Hardcoded URL

The skill invokes `runcomfy run google/nano-banana-2/edit` with a JSON body matching the schema. The

Line 177 documents the concrete RunComfy API endpoint and output download domains used by the CLI. This is intended network behavior, but it is real outbound connectivity.

Audited by: codex

Audit version 4

Jul 5, 2026, 01:39 PM

The skill is a RunComfy CLI guide for Nano Banana 2 image editing. Confirmed risks are limited to expected external CLI execution, remote API submission, and credential handling. Markdown fences, placeholder URLs, and token-path documentation caused several false positives; no prompt injection or malicious intent was found.

1

Files scanned

186

Lines analyzed

13

Review items

0

False positives ignored

Capability review items (10)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:23-25 SKILL.md:67-74 SKILL.md:78-87 SKILL.md:91-98

Ruby/shell backtick execution

Calls `runcomfy run google/nano-banana-2/edit` through the local

The description states that the skill calls runcomfy run google/nano-banana-2/edit through the local CLI. This is expected functionality, but it is real external command execution.

Medium

Ruby/shell backtick execution · 4 occurrences

```bash

The bash block tells the user to run npx skills add from a remote repository. Remote package execution is legitimate here but requires user trust and confirmation.

Medium

Ruby/shell backtick execution

1. **RunComfy CLI** — `npm i -g @runcomfy/cli`

The prerequisite instructs npm i -g @runcomfy/cli. Installing a global CLI can execute package code and modify the user environment.

Medium

Ruby/shell backtick execution

2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.

The prerequisite instructs runcomfy login, which starts an external auth flow and creates a credential. This is normal for the service but still security-relevant.

Medium

Ruby/shell backtick execution

The skill invokes `runcomfy run google/nano-banana-2/edit` with a JSON body matching the schema. The

The How it works section says the CLI submits to the model API, polls, fetches results, and downloads files. This confirms command-driven network and filesystem activity.

Medium

SKILL.md:181

Ruby/shell backtick execution

- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m

The security section describes runcomfy login storing an API token. This is legitimate credential handling but still security-sensitive external CLI behavior.

Low

Hardcoded URL

The skill invokes `runcomfy run google/nano-banana-2/edit` with a JSON body matching the schema. The

The How it works section names the RunComfy model API and output download domains. This is expected, but prompts and image URLs leave the local environment.

Audited by: codex

Audit version 3

Jul 5, 2026, 01:39 PM

The skill is a RunComfy CLI guide for Nano Banana 2 image editing. Confirmed risks are limited to expected external CLI execution, remote API submission, and credential handling. Markdown fences, placeholder URLs, and token-path documentation caused several false positives; no prompt injection or malicious intent was found.

1

Files scanned

186

Lines analyzed

13

Review items

0

False positives ignored

Capability review items (10)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:23-25 SKILL.md:67-74 SKILL.md:78-87 SKILL.md:91-98

Ruby/shell backtick execution

Calls `runcomfy run google/nano-banana-2/edit` through the local

The description states that the skill calls runcomfy run google/nano-banana-2/edit through the local CLI. This is expected functionality, but it is real external command execution.

Medium

Ruby/shell backtick execution · 4 occurrences

```bash

The bash block tells the user to run npx skills add from a remote repository. Remote package execution is legitimate here but requires user trust and confirmation.

Medium

Ruby/shell backtick execution

1. **RunComfy CLI** — `npm i -g @runcomfy/cli`

The prerequisite instructs npm i -g @runcomfy/cli. Installing a global CLI can execute package code and modify the user environment.

Medium

Ruby/shell backtick execution

2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.

The prerequisite instructs runcomfy login, which starts an external auth flow and creates a credential. This is normal for the service but still security-relevant.

Medium

Ruby/shell backtick execution

The skill invokes `runcomfy run google/nano-banana-2/edit` with a JSON body matching the schema. The

The How it works section says the CLI submits to the model API, polls, fetches results, and downloads files. This confirms command-driven network and filesystem activity.

Medium

SKILL.md:181

Ruby/shell backtick execution

- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m

The security section describes runcomfy login storing an API token. This is legitimate credential handling but still security-sensitive external CLI behavior.

Low

SKILL.md:10 SKILL.md:67-73 SKILL.md:177

Hardcoded URL

The skill invokes `runcomfy run google/nano-banana-2/edit` with a JSON body matching the schema. The

The How it works section names the RunComfy model API and output download domains. This is expected, but prompts and image URLs leave the local environment.

Audited by: codex

Audit version 2

Jun 29, 2026, 08:40 PM

Static analysis flagged many command, URL, filesystem, and blocker patterns, but most are Markdown examples or documented service endpoints. The confirmed risk is legitimate but meaningful: the skill directs a local RunComfy CLI to send prompts and image URLs to a third-party API and write outputs locally. No evidence found of malicious intent, prompt injection, credential exfiltration, or hidden executable code in SKILL.md.

1

Files scanned

186

Lines analyzed

6

Review items

2

False positives ignored

Capability review items (3)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

External CLI Sends Image Data to RunComfy

TRUE_POSITIVE. The skill instructs agents to run the RunComfy CLI for Nano Banana edits. This is core functionality, but prompts and image URLs are sent to an external model API.

The documented invocation and API behavior are explicit. The risk is confirmed data sharing with a third-party service, not evidence of malware.

Medium

SKILL.md:73 SKILL.md:86 SKILL.md:97 SKILL.md:181

Local Token and Output File Handling

TRUE_POSITIVE. The skill documents token storage in a hidden home-directory config path and writes generated files to an output directory. This is expected for a CLI service, but it requires normal credential and path hygiene.

The file paths and token location are directly documented. I did not find evidence that the skill reads unrelated files or bypasses permissions.

Low

SKILL.md:13 SKILL.md:19 SKILL.md:173 SKILL.md:177 SKILL.md:184

Hardcoded URLs Are Documented Service Endpoints

NEEDS_REVIEW. The hardcoded URLs point to RunComfy documentation, the model API, and example image inputs. They are expected for this skill, but users should understand the external service dependency.

The destination domains are openly documented and align with the skill purpose. I did not find callbacks, telemetry endpoints, or unrelated exfiltration domains.

Static false positives ignored (2)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low

SKILL.md:23-25 SKILL.md:42-44 SKILL.md:67-73

Markdown Command Examples Trigger Static Alerts

FALSE_POSITIVE. Many command-execution alerts are inline code, tables, or fenced examples in documentation. They are not hidden scripts, automatic hooks, or executable files.

SKILL.md is documentation, and the flagged backticks appear in Markdown examples. The only real execution happens when the user or agent runs the documented CLI.

Low

SKILL.md:4-10 SKILL.md:71 SKILL.md:82 SKILL.md:95 SKILL.md:162-170

Path Traversal and Cryptography Alerts Are Benign Text

FALSE_POSITIVE. The path traversal alerts are placeholder HTTPS image URLs using ellipses. The weak cryptography alerts match descriptive text, not cryptographic code or unsafe hashing.

The relevant lines are Markdown prose, endpoint examples, and an exit-code table. I did not find code that performs traversal or cryptographic operations.

Risk Factors

⚙️ External commands (7)

SKILL.md:10 SKILL.md:23-25 SKILL.md:42-44 SKILL.md:67-73 SKILL.md:78-86 SKILL.md:91-97 SKILL.md:177

🌐 Network access (10)

SKILL.md:13 SKILL.md:19 SKILL.md:53 SKILL.md:61 SKILL.md:71 SKILL.md:82 SKILL.md:95 SKILL.md:173 SKILL.md:177 SKILL.md:184

📁 Filesystem access (4)

SKILL.md:73 SKILL.md:86 SKILL.md:97 SKILL.md:181

Detected Patterns

User-Directed External Command Invocation

Audited by: codex

Audit version 1

May 28, 2026, 09:29 AM

Static analysis flagged 78 potential issues, but evaluation reveals all are false positives. The skill is a thin wrapper for the RunComfy CLI that invokes `runcomfy run google/nano-banana-2/edit` to call a legitimate image editing API. The "external commands" detections are markdown bash command examples, not executable code. The "path traversal" flags reference placeholder parameter examples (`<absolute/path>`) in documentation. The "weak crypto" detection is frontmatter YAML. Network access is scoped to RunComfy API endpoints only. Security controls are properly documented including JSON string transmission (no shell injection) and secure token storage with mode 0600.

1

Files scanned

186

Lines analyzed

8

Review items

0

False positives ignored

Confirmed security concerns (3)

High

SKILL.md:4 SKILL.md:162

Static Analysis Pattern Detected: Weak Cryptographic Algorithm

Scanner flagged lines 4 and 162 as containing weak crypto. Evaluation shows this is a false positive: line 4 is YAML frontmatter with model documentation, line 162 is exit code documentation. No cryptographic operations present in this skill.

Static scanner detected pattern in YAML frontmatter and exit code table that triggered crypto detection heuristic, but neither contains cryptographic operations.

High

SKILL.md:181

Static Analysis Pattern Detected: Hidden File Access

Scanner flagged line 181 as hidden file access. Evaluation shows this is documented security practice: token is stored at `~/.config/runcomfy/token.json` with mode 0600 (owner-only read/write). This is intentional secure credential handling, not a vulnerability.

Line 181 explicitly documents secure token storage with appropriate file permissions. This is a security best practice, not an exploitation of hidden files.

Low

SKILL.md:38

Static Analysis Pattern Detected: System Reconnaissance

Scanner flagged line 38 as system reconnaissance. Evaluation shows this is simple user intent detection for routing requests to the correct skill.

Line 38 contains routing logic for skill selection based on explicit user phrase matching ('nano banana edit'). Standard skill triggering pattern, not reconnaissance.

Capability review items (3)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SKILL.md:71 SKILL.md:82 SKILL.md:95

Static Analysis Pattern Detected: Path Traversal

Scanner flagged lines 71, 82, 95 as path traversal. Evaluation shows this is a false positive: these lines contain `<absolute/value>` style placeholder examples in documentation explaining CLI parameter types. These are not actual path traversal attempts.

Scanner flagged `<absolute/path>` parameter examples as traversal, but these are documented CLI parameter type examples with placeholder names, not actual code execution.

Medium