安全扫描
OpenClaw
可疑
medium confidenceThe skill appears to do what it says (generate/edit images with Gemini) and requests only the Gemini API key, but there are small inconsistencies in metadata and declared dependencies that deserve attention before installing.
评估建议
This skill mostly looks like a legitimate Gemini image helper, but there are a few packaging inconsistencies you should check before installing: 1) Confirm you trust the source—registry ownerId vs _meta.json ownerId differ. 2) Ensure you are comfortable providing GEMINI_API_KEY (this is the only credential requested). 3) The SKILL.md and script disagree about Python dependencies: the script needs google-genai and pillow, while SKILL.md lists requests and beautifulsoup4; your environment must hav...详细分析 ▾
ℹ 用途与能力
Name/description, required binary (uv), and primary env var (GEMINI_API_KEY) align with the included script which calls google.genai. However the SKILL.md metadata lists dependencies (requests, beautifulsoup4) that the script never imports, while the script header and imports require google-genai and pillow. Also the ownerId in _meta.json differs from the registry ownerId in the provided metadata—these mismatches are packaging/authoring inconsistencies.
✓ 指令范围
Runtime instructions are narrowly scoped: run the bundled script with prompt/filename and optional input images. The script only reads input images you explicitly pass, uses the GEMINI_API_KEY or --api-key, uploads content to Google's GenAI client, and writes the generated PNG to the requested output path. It prints a MEDIA:<path> token for attachment and does not attempt to read unrelated files or exfiltrate other environment variables.
ℹ 安装机制
Install spec only installs the 'uv' brew formula, which matches the expected runtime invocation. There is no automated installation declared for the Python packages the script needs (google-genai, pillow). That mismatch means the script may fail at runtime unless the environment already provides those Python deps; it's an operational inconsistency rather than an explicit security issue.
✓ 凭证需求
Only GEMINI_API_KEY is required (declared as primaryEnv). The script uses only that key (or --api-key). No other credentials, secrets, or unrelated environment variables are requested.
✓ 持久化与权限
The skill does not request always:true, does not modify other skills or global configs, and does not persist credentials itself. It only writes generated image files to the user-specified output path.
安全有层次,运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.22026/3/26
- Added detailed usage instructions for Nano Banana Pro, including image generation, editing, and multi-image composition. - Documented required dependencies, runner, and API key setup (GEMINI_API_KEY). - Outlined supported resolutions and aspect ratios, with flags for custom settings. - Provided guidance for filename conventions and output handling. - Included installation steps for required tools (uv via brew).
● 无害
安装命令 点击复制
官方npx clawhub@latest install openclaw-pro-nano-banana-pro-1-0-2
镜像加速npx clawhub@latest install openclaw-pro-nano-banana-pro-1-0-2 --registry https://cn.clawhub-mirror.com
技能文档
Use the bundled script to generate or edit images.
Generate
uv run {baseDir}/scripts/generate_image.py --prompt "your image description" --filename "output.png" --resolution 1K
Edit (single image)
uv run {baseDir}/scripts/generate_image.py --prompt "edit instructions" --filename "output.png" -i "/path/in.png" --resolution 2K
Multi-image composition (up to 14 images)
uv run {baseDir}/scripts/generate_image.py --prompt "combine these into one scene" --filename "output.png" -i img1.png -i img2.png -i img3.png
API key
GEMINI_API_KEYenv var (必填 - 获取 键 从 https://aistudio.google.com/app/apikey)- 或 设置
skills."nano-banana-pro".apiKey/skills."nano-banana-pro".env.GEMINI_API_KEY在...中~/.openclaw/openclaw.json
To set the API key:
- 获取 键 从 https://aistudio.google.com/app/apikey
- 设置 作为 environment 变量:
导出 GEMINI_API_KEY="-键-这里" - 或 添加 到 OpenClaw 配置 在...中
~/.openclaw/openclaw.json
Specific aspect ratio (optional)
uv run {baseDir}/scripts/generate_image.py --prompt "portrait photo" --filename "output.png" --aspect-ratio 9:16
Notes
- Resolutions:
1K(默认),2K,4K. - Aspect ratios:
1:1,2:3,3:2,3:4,4:3,4:5,5:4,9:16,16:9,21:9. 没有--aspect-ratio/-, 模型 picks freely - 使用 标志 对于 avatars, 个人资料 pics, 或 consistent batch generation. - 使用 timestamps 在...中 filenames:
yyyy-mm-dd-hh-mm-ss-name.png. - script prints
MEDIA:line 对于 OpenClaw 到 auto-attach 在...上 supported chat providers. - 做 不 读取 image back; 举报 saved path 仅.
数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制