← Back to Skills Marketplace
ZenMux Image Gen (Nano Banana 2)
by
thinkthinking
· GitHub ↗
· v1.0.0
369
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install zenmux-image-gen
Description
Generate images from text prompts using ZenMux API (Vertex AI protocol with Gemini models). Use when: (1) User wants to generate/create images from text desc...
Usage Guidance
This skill appears to implement a legitimate ZenMux image-generation client, but exercise caution: (1) the package metadata does not declare the ZENMUX_API_KEY even though both SKILL.md and the script require it — verify the publisher and why metadata is incomplete; (2) the provided script appears truncated in the bundle listing (file output was cut off), so request or review the full script before running — the missing tail could contain unexpected behavior; (3) follow the SKILL.md advice and do not pass API keys on the command line; set ZENMUX_API_KEY in a secure environment variable instead; (4) confirm network endpoints (the script calls only zenmux.ai) and, if you must run it, do so in an isolated environment/container and inspect the full source; (5) if you need higher assurance, ask the publisher for complete source and a signed release or prefer an official client from zenmux.ai.
Capability Analysis
Type: OpenClaw Skill
Name: zenmux-image-gen
Version: 1.0.0
The skill bundle is primarily benign, providing a legitimate tool for image generation via the ZenMux API. The `SKILL.md` contains clear, non-malicious instructions for the AI agent. The `scripts/generate_image.py` script uses safe practices like `argparse` for argument handling, `urllib.request` for API calls, and `os`/`pathlib` for file operations, mitigating common shell injection risks. However, a vulnerability exists in `scripts/generate_image.py` where the user-controlled `--model` argument is directly inserted into the URL path (e.g., `https://zenmux.ai/api/vertex-ai/v1/publishers/{provider}/models/{model_name}:generateContent`). This could allow for URL path traversal (e.g., `google/gemini-model/../../evil-path`) within the `zenmux.ai` domain, potentially leading to malformed requests or attempts to access unintended API endpoints on the ZenMux server. While this is a vulnerability, it does not demonstrate clear intent for data exfiltration, remote code execution, or persistence on the agent's system, thus classifying it as 'suspicious' rather than 'malicious'.
Capability Assessment
Purpose & Capability
The name, description, SKILL.md, and the script all target ZenMux image generation (Vertex AI/Gemini models). That purpose aligns with the code's network calls to https://zenmux.ai/... and the CLI options. However, the registry metadata claims 'Required env vars: none' whereas SKILL.md and the script explicitly require ZENMUX_API_KEY — this mismatch suggests sloppy metadata or incomplete publishing.
Instruction Scope
Runtime instructions and the script stay within the stated purpose: building a request from a prompt (and optional input image), POSTing to the ZenMux Vertex-like endpoint, and saving returned image bytes. The SKILL.md warns not to pass API keys on the command line (good). The SKILL.md and script do not request unrelated system files, other credentials, or external endpoints beyond zenmux.ai.
Install Mechanism
This is an instruction-only skill with no install spec; the included script is executed directly. No download/install steps or third-party package pulls are present in the manifest, which reduces install-time risk.
Credentials
The code and SKILL.md require a ZENMUX_API_KEY (or --api-key) to call the API, which is proportionate to the task. But the registry metadata declares no required env vars — an inconsistent declaration. Additionally, the script provides a --api-key CLI flag even though the SKILL.md explicitly warns against using it (exposure risk via shell history). No other credentials are requested, which is appropriate.
Persistence & Privilege
The skill does not request persistent/always-on presence and does not modify other skills or system config. It runs as a normal user-invokable script and does not escalate privileges in the visible code.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install zenmux-image-gen - After installation, invoke the skill by name or use
/zenmux-image-gen - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
- Initial release of zenmux-image-gen skill.
- Generate images from text prompts using the ZenMux API and Google Gemini models.
- Supports aspect ratio and resolution controls, as well as image-to-image editing.
- Provides a command-line script with options for model selection, prompt details, and output customization.
- Requires ZENMUX_API_KEY for secure API access.
- Includes clear setup instructions, prompt tips, error troubleshooting, and batch generation examples.
Metadata
Frequently Asked Questions
What is ZenMux Image Gen (Nano Banana 2)?
Generate images from text prompts using ZenMux API (Vertex AI protocol with Gemini models). Use when: (1) User wants to generate/create images from text desc... It is an AI Agent Skill for Claude Code / OpenClaw, with 369 downloads so far.
How do I install ZenMux Image Gen (Nano Banana 2)?
Run "/install zenmux-image-gen" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is ZenMux Image Gen (Nano Banana 2) free?
Yes, ZenMux Image Gen (Nano Banana 2) is completely free (open-source). You can download, install and use it at no cost.
Which platforms does ZenMux Image Gen (Nano Banana 2) support?
ZenMux Image Gen (Nano Banana 2) is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created ZenMux Image Gen (Nano Banana 2)?
It is built and maintained by thinkthinking (@thinkthinking); the current version is v1.0.0.
More Skills