by 安全扫描
OpenClaw
安全
high confidenceThe skill's files, instructions, and required credentials align with its stated purpose (image generation/editing via Atlas Cloud or Google AI Studio); nothing suggests misdirection or unrelated access, though there's a small metadata wording mismatch about required env vars.
评估建议
This skill appears to do what it says: it sends prompts and (with your explicit consent) image files to Atlas Cloud or Google AI Studio and returns generated images. Before installing, consider: (1) the SKILL.md requires you to confirm any local-file uploads — make sure the agent actually asks you before uploading sensitive photos; (2) the registry metadata vs. SKILL.md wording: you only need at least one provider key, not necessarily both — set only the provider key you trust to reduce accident...详细分析 ▾
✓ 用途与能力
The skill claims to call Atlas Cloud or Google AI Studio for image generation and the code + SKILL.md request exactly the corresponding API keys and endpoints. Requiring ATLASCLOUD_API_KEY and/or GEMINI_API_KEY is proportionate to the stated functionality; primaryEnv being ATLASCLOUD_API_KEY is reasonable given Atlas Cloud is the default provider.
✓ 指令范围
SKILL.md and the included script limit actions to submitting prompts, uploading local images (with explicit user consent required in the doc), polling for results, and downloading outputs. The instructions do send data to third-party endpoints (api.atlascloud.ai and generativelanguage.googleapis.com) which is expected for this skill and is explicitly called out with a privacy note.
✓ 安装机制
There is no install spec (instruction-only plus a small Python script). No downloads or archive extraction are requested. The script uses only Python standard library (urllib), so there is no opaque install-time code execution risk.
ℹ 凭证需求
Requesting Atlas Cloud and Google API keys is justified. Minor inconsistency: registry metadata lists both ATLASCLOUD_API_KEY and GEMINI_API_KEY as 'required env vars', while SKILL.md states 'At least one of the above must be set' and the script supports choosing either provider. This is a documentation/metadata mismatch rather than an unexplained privilege request.
✓ 持久化与权限
The skill is not always-included, does not request system-wide configuration changes, and does not persist credentials on its own. Autonomous invocation is allowed by platform default but does not combine with any other broad privileges in this skill.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.92026/3/9
- Added `metadata.openclaw.requires.env` and `primaryEnv` fields to formally declare required environment variables and primary provider. - No changes to functionality or code; documentation was updated to include structured metadata for environment requirements. - Ensures better compatibility and clarity for OpenClaw and related tools by explicitly specifying required configuration.
● 无害
安装命令
点击复制官方npx clawhub@latest install nano-banana-2-skill
镜像加速npx clawhub@latest install nano-banana-2-skill --registry https://cn.longxiaskill.com