Skip to content
skillsafebeta
← Report library
Purpose / Other

Nano Banana Edit Skill Security Audit

What the author says it does (original text)

>

Independent security check

Security risks found

Files checked
1
Risks found
4
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

Installation globally introduces and executes externally published software

Source references: 5
What we found

The instructions globally install the RunComfy CLI through npm and globally add the Skill from an external GitHub repository using `npx skills add`. Later operations trust that CLI with the account token, network requests, and output files. No package version or integrity hash is pinned in the supplied material.

Why this matters

If the npm package, repository, publisher account, or dependency chain is compromised, installed or executed code could access files and credentials with the user's permissions, alter global tool configuration, or make additional network requests. There is no evidence here that such compromise has occurred.

The instructions globally install an unpinned npm CLI and globally add the Skill from an external repository through `npx`. That CLI then handles login, stores an API token, makes remote requests, and writes downloaded results to a chosen directory. These are normal functions for the stated service, but they give third-party software access to credentials, networking, and file output. No version or integrity check is provided; users can require a pinned, verified release and restrict output to a dedicated directory.

SKILL.md:24In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill nano-banana-edit -g```
Show 4 other places
SKILL.md:42In the instructionsOpen original file
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>` instead of `runcomfy login`.
SKILL.md:177In the instructionsOpen original file
The skill invokes `runcomfy run google/nano-banana-2/edit` with a JSON body matching the schema. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/google/nano-banana-2/edit`, polls the request, fetches the result, and downloads any `.runcomfy.net`/`.runcomfy.com` URL into `--output-dir`. `Ctrl-C` cancels the remote request before exit.
SKILL.md:23In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill nano-banana-edit -g```
SKILL.md:181In the instructionsOpen original file
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600 (owner-only read/write). Set `RUNCOMFY_TOKEN` env var to bypass the file entirely in CI / containers.- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Input images are fetched and processed by a third-party server

Source references: 4
What we found

Editing requires publicly fetchable HTTPS image URLs. The documentation states that the RunComfy model server fetches them and that the request is sent to RunComfy's API, so both image content and URLs leave the user's device.

Why this matters

RunComfy may receive faces, unreleased assets, customer products, location clues, or access tokens embedded in URLs. Making private images publicly fetchable can also widen their exposure.

Actual edits require 1–20 publicly fetchable HTTPS image URLs. The documentation says RunComfy’s server fetches those URLs and submits the request to its model API, so the images, URLs, and edit prompt leave the device for third-party processing. Public URLs may also be accessible to anyone holding them. No retention or downstream-use policy is shown; users can limit uploads to authorized, de-identified images and ask about retention and training use.

SKILL.md:53In the instructionsOpen original file
| `prompt` | string | yes | — | Edit instruction. Lead with preservation, end with the change. || `image_urls` | array | yes | — | **1–20** publicly-fetchable HTTPS URLs. || `number_of_images` | int | no | 1 | 1–4 outputs per call. |
Show 3 other places
SKILL.md:177In the instructionsOpen original file
The skill invokes `runcomfy run google/nano-banana-2/edit` with a JSON body matching the schema. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/google/nano-banana-2/edit`, polls the request, fetches the result, and downloads any `.runcomfy.net`/`.runcomfy.com` URL into `--output-dir`. `Ctrl-C` cancels the remote request before exit.
SKILL.md:183In the instructionsOpen original file
- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.- **Third-party content**: image / mask / video URLs you pass are fetched by the RunComfy model server, not by the CLI on your machine. Treat external URLs as untrusted; image-based prompt injection is a known risk for any image-edit / video-edit model.- **Outbound endpoints**: only `model-api.runcomfy.net` (request submission) and `*.runcomfy.net` / `*.runcomfy.com` (download whitelist for generated outputs). No telemetry, no callbacks.
SKILL.md:52In the instructionsOpen original file
|---|---|---|---|---|| `prompt` | string | yes | — | Edit instruction. Lead with preservation, end with the change. || `image_urls` | array | yes | — | **1–20** publicly-fetchable HTTPS URLs. || `number_of_images` | int | no | 1 | 1–4 outputs per call. || `seed` | int | no | — | Reproducibility. |
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Low risk

The install command does not pin a dependency version

Source references: 2
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

The install example uses `npx skills add` to add the Skill globally from an external repository without pinning a commit, tag, or version. Running it later could therefore retrieve code different from the text audited here. The source does not show that it was executed or what was installed; users can ask for a pinned release or commit and a verification method.

SKILL.md:24In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill nano-banana-edit -g```
Show 1 other places
SKILL.md:23In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill nano-banana-edit -g```
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Low risk

Batch, multi-output, multi-pass edits and web search can increase service charges

Source references: 4
What we found

A call can request up to four outputs, the guidance recommends splitting drifting edits into two passes, and it explicitly says web search adds cost. The Skill does not show pricing, a budget cap, or a payment confirmation step in its invocation examples.

Why this matters

Processing many inputs, iterating repeatedly, or enabling web search could create higher-than-expected usage charges on the user's RunComfy account.

The schema permits 1–4 outputs per call, recommends splitting a drifting edit into two passes, and explicitly says web search adds cost and latency. Although it claims two similar-resolution passes have the same total cost, no pricing, account budget cap, or payment-confirmation mechanism is shown. More outputs or web search can therefore increase charges; the cost of extra passes cannot be quantified from this source alone. Users can request a cost preview and caps on outputs, resolution, and web search.

SKILL.md:54In the instructionsOpen original file
| `image_urls` | array | yes | — | **1–20** publicly-fetchable HTTPS URLs. || `number_of_images` | int | no | 1 | 1–4 outputs per call. || `seed` | int | no | — | Reproducibility. |
Show 3 other places
SKILL.md:61In the instructionsOpen original file
| `limit_generations` | bool | no | — | If true, restricts each round to one output. || `enable_web_search` | bool | no | false | Web grounding (extra cost / latency). |
SKILL.md:108In the instructionsOpen original file
**Iterate small.** If a one-pass edit drifts, split into two: pass 1 changes background only, pass 2 swaps the subject's outfit. Cleaner edits, same total cost (assuming similar resolution).
SKILL.md:159In the instructionsOpen original file
- **Long compound prompts drift** — split into multiple passes.- **Web search adds latency + cost** — only enable on demand.- **For multilingual in-image text edits, GPT Image 2 edit wins.**

Inside this skill

8 instruction sections

The Skill itself provides instructions; the actual edit is performed when the local RunComfy CLI submits JSON to RunComfy's remote model API, polls for results, and downloads generated files to the selected directory.

View source
SKILL.md:177In the instructionsOpen original file
The skill invokes `runcomfy run google/nano-banana-2/edit` with a JSON body matching the schema. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/google/nano-banana-2/edit`, polls the request, fetches the result, and downloads any `.runcomfy.net`/`.runcomfy.com` URL into `--output-dir`. `Ctrl-C` cancels the remote request before exit.

The service requires a RunComfy account. Interactive login stores an API token in the user's configuration directory, while CI can supply it through an environment variable.

View source
SKILL.md:43In the instructionsOpen original file
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>` instead of `runcomfy login`.
SKILL.md:181In the instructionsOpen original file
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600 (owner-only read/write). Set `RUNCOMFY_TOKEN` env var to bypass the file entirely in CI / containers.- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.

Each request can give the remote service 1–20 publicly fetchable HTTPS image URLs and request 1–4 outputs; web search is disabled by default.

View source
SKILL.md:53In the instructionsOpen original file
| `prompt` | string | yes | — | Edit instruction. Lead with preservation, end with the change. || `image_urls` | array | yes | — | **1–20** publicly-fetchable HTTPS URLs. || `number_of_images` | int | no | 1 | 1–4 outputs per call. || `seed` | int | no | — | Reproducibility. |
SKILL.md:61In the instructionsOpen original file
| `limit_generations` | bool | no | — | If true, restricts each round to one output. || `enable_web_search` | bool | no | false | Web grounding (extra cost / latency). |
Start here · InstructionsSKILL.md
nano-banana-edit
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 3 more sections are available in the original file.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites
SKILL.md:13In the instructionsOpen original file
  "image edit nano banana", or any explicit ask to edit with this model.homepage: https://www.runcomfy.comlicense: MIT
SKILL.md:19In the instructionsOpen original file
[runcomfy.com](https://www.runcomfy.com/?utm_source=skills.sh&utm_medium=skill&utm_campaign=nano-banana-edit) · [Edit endpoint](https://www.runcomfy.com/models/google/nano-banana-2/edit?utm_source=skills.sh&utm_medium=skill&utm_campaign=nano-banana-edit) · [GitHub](https://github.com/agentspace-so/runcomfy-skills/tree/main/nano-banana-edit)
SKILL.md:71In the instructionsOpen original file
    "prompt": "Keep the subject identity, pose, and clothing unchanged. Convert the background into a rainy neon cyberpunk street.",    "image_urls": ["https://.../portrait.jpg"]  }' \
Run commands
SKILL.md:23In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill nano-banana-edit -g
SKILL.md:67In the instructionsOpen original file
```bashruncomfy run google/nano-banana-2/edit \
SKILL.md:78In the instructionsOpen original file
```bashruncomfy run google/nano-banana-2/edit \
Install extra software packages
SKILL.md:24In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill nano-banana-edit -g```
Lines read
186
File checksum (to compare versions)
49d7a9af52796e3666f171471bee722863440c3af68d52f15eabbda55f55b65f