Versioned security assessment

Report ID: SA-A0668140

7/6/2026, 2:48:20 PM

nano-banana security assessment v4

Skill Security Certification Report

Audit History
Audit model: codex Latest published report
Skill name
nano-banana
Version
v4
Maintainer
inference-sh-9
Source
github.com/inference-sh-9/skills/tree/main/skills/nano-banana/
Coverage
1 Files scanned · 144 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Critical

3 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The audit confirmed a critical pipe-to-shell installer in the Quick Start and one network finding tied to that installer. Most external-command findings are Markdown backtick false positives, but the skill also grants broad infsh CLI access. The skill should not be auto-installed until installer guidance and external data handling are tightened.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 144 Lines analyzed

5 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 8 evidence locations

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 30 evidence locations

Capability review items (2)
Critical
SKILL.md:16
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh && infsh login
The URL is not just a documentation link; it is the source for a script executed by sh on the same line. Compromise of that endpoint could lead to arbitrary code execution.
Low
SKILL.md:11
Hardcoded URL
![Nano Banana](https://cloud.inference.sh/u/33sqbmzt3mrg2xxphnhw5g5ear/01k8d6xa9cwawrvzk9cgtsexfc.pn
The Markdown image embeds remote content from cloud.inference.sh, which renderers may fetch automatically. This is a low privacy and tracking risk, not direct code execution.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (3)

RISK-001 Critical
SKILL.md:16
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh && infsh login
The Quick Start downloads a remote script from cli.inference.sh and pipes it directly to sh. This gives the remote endpoint shell execution before the user can inspect the installer.
RISK-002 Medium
SKILL.md:4
Broad External CLI Permission
The skill grants Bash access to `infsh *`, allowing any inference.sh CLI subcommand. This can send prompts, image URLs, and local input files to external services when the agent runs commands.
The allowed-tools directive directly permits all infsh subcommands. The examples show networked model calls, so the external service exposure is real.
RISK-003 Medium
SKILL.md:21
Unverified Installer Safety Assurance
The skill states that the remote install script has limited behavior and checksum verification, but it does not pin a script hash or version. This reassurance can make users trust the pipe-to-shell command without independent inspection.
The safety claim is explicit in the install note. The file provides a checksum link but no pinned expected value inside the skill.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Critical
    Remote shell installer in Quick Start
    Replace the curl-to-shell command with manual download, version pinning, and explicit checksum verification before execution.
  2. FIX-002
    Medium
    Broad infsh command permission
    Limit allowed commands where possible and require explicit user confirmation before sending prompts, images, or local files to external services.
  3. FIX-003
    Medium
    Installer safety claims are not pinned
    Include a pinned installer version and expected checksum in the skill text, or link users to manual verification first.
  4. FIX-004
    Low
    Remote Markdown image asset
    Use a marketplace-hosted or local asset to avoid automatic requests to a third-party image host during rendering.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
a06681402992ceae98ba04d54cfd4ab004862696
Content hash
7c7b1aef028e6ca5fb18cfe80d3e9de1ea9d7ce2bae5c0434e8a9773c9ad920e
Tree hash
b10f8a93440d9eec8ff87104175d4b1425e3ee870e1c27a4270bd267ac54c12f
Skill path
skills/inference-sh-9/nano-banana
Audit payload hash
b2df7af27685a5e976845b7f013eb34e

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable