Nano Banana Image T8

调用 Nano Banana API 生成或编辑图片，支持文生图和图生图，需提供API Key和提示词，支持自定义尺寸比例。

This skill appears to do what it claims: call an external image-generation API and save outputs locally. Before installing, consider: 1) Network/data: the script will upload prompts and any input images to the remote host (default https://ai.t8star.cn). Do not upload sensitive images or reuse high-privilege API keys you aren’t comfortable sending to that endpoint. 2) Key persistence: the API key can be saved to ~/.whaleclaw/credentials/nano_banana_api_key.txt (file perms 600 on non-Windows) — remove it if you don’t want long-term stored credentials. 3) Policy mismatch: SKILL.md forbids changing the API base URL and restricts when a key may be captured/saved, but the script includes a --base-url flag and will save any key entered interactively; so the enforcement is partly manual. 4) Non-interactive WebChat usage: the SKILL.md requires non-interactive, param-driven runs (pass --api-key or env var); make sure the agent/system will supply keys only in the intended scenarios. If you need stronger guarantees, ask the author to remove the --base-url override and to implement programmatic checks that enforce the SKILL.md capture/save rules (so keys are only stored under the declared conditions).

Type: OpenClaw Skill Name: nano-banana-image-t8-alluse Version: 0.1.4 The skill bundle provides image generation and editing capabilities by interfacing with the Nano Banana API (ai.t8star.cn). The included Python script (test_nano_banana_2.py) handles API requests and manages user credentials by saving the API key to a local file with restricted permissions (600). The instructions in SKILL.md are security-conscious, explicitly directing the AI agent to only capture API keys within the specific context of this skill and forbidding the scanning of unrelated directories. No evidence of malicious intent, data exfiltration to unauthorized domains, or suspicious execution patterns was found.