Is dycathecorde/nano-banana-pro-2 safe?
Yes. dycathecorde/nano-banana-pro-2 is safe to install. Oathe's behavioral security audit gave the nano-banana-pro-2 skill by dycathecorde a trust score of 85/100 with 3 findings, none critical or high.
https://github.com/openclaw/skills/tree/main/skills/dycathecorde/nano-banana-pro-2
Is dycathecorde/nano-banana-pro-2 safe to install?
This is a legitimate image generation skill that uses Google's Gemini 3 Pro Image API. The skill contains straightforward Python code for image generation with no apparent malicious behavior. Main concern is sensitive file access during installation, which appears to be system-level rather than skill-specific.
What security issues were found in dycathecorde/nano-banana-pro-2?
Category Scores
Findings (3)
MEDIUM Sensitive file access during installation -25 ▶
Monitoring detected access to sensitive canary files (.env, .ssh/id_rsa, .aws/credentials, etc.) during skill installation. While this appears to be system-level activity during git clone and SSH operations rather than the skill itself, any access to sensitive files warrants attention.
LOW Executable Python script -15 ▶
The skill contains executable Python code for image generation functionality. This is expected and legitimate for the skill's purpose but represents code execution capability.
INFO External API dependency -12 ▶
Skill requires GEMINI_API_KEY environment variable and makes API calls to Google's Gemini service. This is expected functionality but creates external dependency.
Should I install dycathecorde/nano-banana-pro-2?
Oathe's verdict for dycathecorde/nano-banana-pro-2 is SAFE with a trust score of 85/100. Recommendation: Install.