Skip to content
skillsafebeta
← Report library
Purpose / Other

Nano Banana 2 Skill Security Audit

What the author says it does (original text)

>

Independent security check

Security risks found

Files checked
1
Risks found
4
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

Installation executes and globally installs third-party software and a Skill

Source references: 3
What we found

The instructions globally install the RunComfy CLI through npm and provide an npx command that globally adds a Skill from a GitHub repository. This executes and persistently installs whatever package or repository content is resolved at that time; neither command pins a version or commit hash.

Why this matters

If an upstream package, dependency, or repository is later replaced or compromised, installation could execute unexpected code and persistently alter global CLI or Skill configuration. The supplied evidence does not establish that such a compromise has occurred.

The documentation provides two persistent installation steps: globally adding the skill from a third-party GitHub repository via npx and globally installing the RunComfy CLI via npm. Neither pins a version or commit, so resolved code may change upstream. This shows installation instructions, not that installation occurred. The user can request pinned revisions and avoid or restrict global installs.

SKILL.md:27In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill nano-banana-2 -g```
Show 2 other places
SKILL.md:50In the instructionsOpen original file
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.
SKILL.md:48In the instructionsOpen original file
## Prerequisites1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>` instead of `runcomfy login`.
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Image prompts are disclosed to RunComfy, with broader processing when web search is enabled

Source references: 5
What we found

The CLI sends the complete JSON request to RunComfy's remote API. When web search is enabled, the prompt is also used for web retrieval. Prompts may contain unreleased product, person, campaign, or customer information.

Why this matters

Sensitive prompts and generation jobs leave the local machine for processing by third-party infrastructure. The document claims outbound-domain restrictions, but no CLI implementation is supplied here to verify them independently.

The workflow sends a JSON request containing the user's prompt to RunComfy's remote API, so prompt content leaves the machine. Enabling `enable_web_search` adds web-grounded external processing, cost, and latency, although the source does not identify a search provider or retention practices. Users should avoid confidential, client, or unreleased information and ask the provider about retention and search handling.

SKILL.md:198In the instructionsOpen original file
The skill invokes `runcomfy run google/nano-banana-2/text-to-image` with a JSON body matching the schema. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/google/nano-banana-2/text-to-image`, polls the request, fetches the result, and downloads any `.runcomfy.net`/`.runcomfy.com` URL into `--output-dir`. `Ctrl-C` cancels the remote request before exit.
Show 4 other places
SKILL.md:68In the instructionsOpen original file
| `limit_generations` | bool | no | true | Limit each prompt round to one generation. || `enable_web_search` | bool | no | false | Adds web grounding (extra cost + latency). |
SKILL.md:205In the instructionsOpen original file
- **Third-party content**: image / mask / video URLs you pass are fetched by the RunComfy model server, not by the CLI on your machine. Treat external URLs as untrusted; image-based prompt injection is a known risk for any image-edit / video-edit model.- **Outbound endpoints**: only `model-api.runcomfy.net` (request submission) and `*.runcomfy.net` / `*.runcomfy.com` (download whitelist for generated outputs). No telemetry, no callbacks.- **Generated-file size cap**: the CLI aborts any single download > 2 GiB to prevent disk-fill from a malicious or runaway model output.
SKILL.md:60In the instructionsOpen original file
|---|---|---|---|---|| `prompt` | string | yes | — | Subject-first description. || `num_images` | int | no | 1 | 1–4. Use 4 for ideation rounds. || `seed` | int | no | 0 | Reuse for reproducibility. || `aspect_ratio` | enum | no | `auto` | `auto`, `21:9`, `16:9`, `3:2`, `4:3`, `5:4`, `1:1`, `4:5`, `3:4`, `2:3`, `9:16`. || `resolution` | enum | no | `1K` | `0.5K` (drafts), `1K` (default), `2K` (final), `4K` (max). || `output_format` | enum | no | `png` | `png`, `jpeg`, `webp`. || `safety_tolerance` | int | no | 4 | 1 (strict) – 6 (permissive). || `limit_generations` | bool | no | true | Limit each prompt round to one generation. || `enable_web_search` | bool | no | false | Adds web grounding (extra cost + latency). |
SKILL.md:125In the instructionsOpen original file
**Consistent seeds for refinement.** Lock `seed` when iterating a single prompt across small variants — keeps composition stable.**Web-grounding, sparingly.** Turn on `enable_web_search` only when the prompt names current events / real entities. Adds latency + cost; off by default.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Low risk

The install command does not pin a dependency version

Source references: 2
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

The install command names a GitHub repository and skill but pins no commit, tag, or version. Running it later could therefore install code different from the material reviewed here. The user can ask for a commit-pinned command and inspect that revision before installation.

SKILL.md:28In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill nano-banana-2 -g```
Show 1 other places
SKILL.md:27In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill nano-banana-2 -g```
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

Broad Google/Gemini requests are routed to an account-based RunComfy service that may incur charges

Source references: 5
What we found

Triggers include “google image gen” and “gemini image,” and the routing rule says an explicit Gemini-image request should still come here. The actual endpoint is hosted by RunComfy, while higher resolutions and web search cost more.

Why this matters

A user seeking Google/Gemini image capability may create a third-party account, disclose data, and incur higher charges without having explicitly selected RunComfy as the provider.

The triggers explicitly include broad phrases such as “google image gen” and “gemini image,” and the routing rule sends explicit Gemini-image requests here. The implementation uses a third-party hosted API requiring a RunComfy account or token, while web search and higher resolutions add cost. This may shape service and spending choices when the user named a model family but not a provider. Users can require confirmation of RunComfy, resolution, and web search first.

SKILL.md:13In the instructionsOpen original file
  Image 2 / Flux 2 / Seedream instead. Calls  `runcomfy run google/nano-banana-2/text-to-image` through the local  RunComfy CLI. Triggers on "nano banana", "nano-banana-2", "nano banana 2",  "google image gen", "gemini image", or any explicit ask to generate  with this model.homepage: https://www.runcomfy.com
Show 4 other places
SKILL.md:46In the instructionsOpen original file
If the user said "Nano Banana" / "nano-banana-2" / "Gemini image" explicitly, route here regardless. If they said "Nano Banana" without specifying 2 vs Pro, default to **Pro** for portraits and **2** for everything else.
SKILL.md:50In the instructionsOpen original file
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>` instead of `runcomfy login`.
SKILL.md:179In the instructionsOpen original file
- **Max 4 outputs per request.**- **Web search adds latency + cost** — only enable on demand.- **2K / 4K cost more** — default to 1K unless user asked for higher.- **For image edit, use the `/edit` endpoint** — not this one.
SKILL.md:177In the instructionsOpen original file
- **Still images only.** No video on this endpoint.- **Max 4 outputs per request.**- **Web search adds latency + cost** — only enable on demand.- **2K / 4K cost more** — default to 1K unless user asked for higher.- **For image edit, use the `/edit` endpoint** — not this one.

Inside this skill

8 instruction sections

This Skill does not generate images locally. It submits the prompt to RunComfy's model API, polls for the result, and downloads generated files to the chosen directory.

View source
SKILL.md:198In the instructionsOpen original file
The skill invokes `runcomfy run google/nano-banana-2/text-to-image` with a JSON body matching the schema. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/google/nano-banana-2/text-to-image`, polls the request, fetches the result, and downloads any `.runcomfy.net`/`.runcomfy.com` URL into `--output-dir`. `Ctrl-C` cancels the remote request before exit.

Use requires a global RunComfy CLI installation and either browser-based login or an API token supplied through an environment variable.

View source
SKILL.md:50In the instructionsOpen original file
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>` instead of `runcomfy login`.

The documentation says the login token is stored in the user's configuration directory with mode 0600; an environment variable can be used instead of creating that file.

View source
SKILL.md:202In the instructionsOpen original file
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600 (owner-only read/write). Set `RUNCOMFY_TOKEN` env var to bypass the file entirely in CI / containers.- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.

Optional web search, higher resolutions, and batch output can change cost or usage; web search is off by default and the default resolution is 1K.

View source
SKILL.md:61In the instructionsOpen original file
| `prompt` | string | yes | — | Subject-first description. || `num_images` | int | no | 1 | 1–4. Use 4 for ideation rounds. || `seed` | int | no | 0 | Reuse for reproducibility. || `aspect_ratio` | enum | no | `auto` | `auto`, `21:9`, `16:9`, `3:2`, `4:3`, `5:4`, `1:1`, `4:5`, `3:4`, `2:3`, `9:16`. || `resolution` | enum | no | `1K` | `0.5K` (drafts), `1K` (default), `2K` (final), `4K` (max). || `output_format` | enum | no | `png` | `png`, `jpeg`, `webp`. || `safety_tolerance` | int | no | 4 | 1 (strict) – 6 (permissive). || `limit_generations` | bool | no | true | Limit each prompt round to one generation. || `enable_web_search` | bool | no | false | Adds web grounding (extra cost + latency). |
SKILL.md:179In the instructionsOpen original file
- **Max 4 outputs per request.**- **Web search adds latency + cost** — only enable on demand.- **2K / 4K cost more** — default to 1K unless user asked for higher.- **For image edit, use the `/edit` endpoint** — not this one.
Start here · InstructionsSKILL.md
nano-banana-2
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 3 more sections are available in the original file.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites
SKILL.md:17In the instructionsOpen original file
  with this model.homepage: https://www.runcomfy.comlicense: MIT
SKILL.md:23In the instructionsOpen original file
[runcomfy.com](https://www.runcomfy.com/?utm_source=skills.sh&utm_medium=skill&utm_campaign=nano-banana-2) · [Model page](https://www.runcomfy.com/models/google/nano-banana-2?utm_source=skills.sh&utm_medium=skill&utm_campaign=nano-banana-2) · [GitHub](https://github.com/agentspace-so/runcomfy-skills/tree/main/nano-banana-2)
SKILL.md:194In the instructionsOpen original file
Full reference: [docs.runcomfy.com/cli/troubleshooting](https://docs.runcomfy.com/cli/troubleshooting?utm_source=skills.sh&utm_medium=skill&utm_campaign=nano-banana-2).
Run commands
SKILL.md:27In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill nano-banana-2 -g
SKILL.md:76In the instructionsOpen original file
```bashruncomfy run google/nano-banana-2/text-to-image \
SKILL.md:84In the instructionsOpen original file
```bashruncomfy run google/nano-banana-2/text-to-image \
Install extra software packages
SKILL.md:28In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill nano-banana-2 -g```
Lines read
207
File checksum (to compare versions)
a6e0157534d43a3627ac495bc6437aa3f26db7a6b0b9b2c2f2a495d406c54827