🖼️

審計歷史

nano-image-generator - 4 審計

審計版本 4

最新 安全

Jan 17, 2026, 08:18 AM

This skill is a legitimate image generation tool using Google's Gemini API. The static analyzer flagged 217 issues, but nearly all are false positives from documentation files containing code examples in markdown. The actual executable code (generate_image.py) contains only legitimate API calls to Google's Gemini service with no malicious behavior.

5
已掃描檔案
922
分析行數
3
發現項
claude
審計者
未發現安全問題

審計版本 3

安全

Jan 17, 2026, 08:18 AM

This skill is a legitimate image generation tool using Google's Gemini API. The static analyzer flagged 217 issues, but nearly all are false positives from documentation files containing code examples in markdown. The actual executable code (generate_image.py) contains only legitimate API calls to Google's Gemini service with no malicious behavior.

5
已掃描檔案
922
分析行數
3
發現項
claude
審計者
未發現安全問題

審計版本 2

低風險

Jan 5, 2026, 09:38 AM

The skill is a legitimate image generation tool using Google's Gemini API. It makes network calls only to the official Google API endpoint, validates user inputs, and handles files safely. The only security concern is that API keys are hardcoded in the script rather than using environment variables.

4
已掃描檔案
408
分析行數
3
發現項
claude
審計者
低風險問題 (1)
API key hardcoded in source code
The Gemini API key is stored directly in the get_api_key() function at line 45. While documented as a setup requirement, this is less secure than using environment variables and could lead to accidental key exposure if the file is shared.

審計版本 1

低風險

Jan 5, 2026, 09:38 AM

The skill is a legitimate image generation tool using Google's Gemini API. It makes network calls only to the official Google API endpoint, validates user inputs, and handles files safely. The only security concern is that API keys are hardcoded in the script rather than using environment variables.

4
已掃描檔案
408
分析行數
3
發現項
claude
審計者
低風險問題 (1)
API key hardcoded in source code
The Gemini API key is stored directly in the get_api_key() function at line 45. While documented as a setup requirement, this is less secure than using environment variables and could lead to accidental key exposure if the file is shared.