通义万相 2.5D 横幅插画

Generate/edit images with Nano Banana Pro (Gemini 3 Pro Image). Use for image create/modify requests incl. edits. Supports text-to-image + image-to-image; 1K...

Do not install or run this skill yet. Steps to safely proceed if you want this capability: 1) Ask the author for a minimal package: SKILL.md + the single generate_image.py script. The skill bundle should not include unrelated workspace files or backups. 2) Require that the skill metadata explicitly list GEMINI_API_KEY as a required env var (primary credential) and update the install/usage paths to match actual file locations. 3) Manually inspect the generate_image.py script before running: search for network endpoints, hard-coded secrets, base64/obfuscated blobs, file reads/writes beyond working directory, and any code that uploads files to unknown servers. 4) Remove any files exposing secrets (the manifest includes a backup file with many API keys/app secrets). Treat those as compromised and rotate those credentials if they are yours. 5) If you must test, run the script in a disposable/sandboxed environment (isolated VM or container) with a throwaway Gemini key and no access to other credentials or sensitive files. Monitor outbound network traffic during a first run. 6) If SKILL.md still contains prompt-injection artifacts (ignore-previous-instructions, base64 blocks, hidden unicode), do not use it; request a cleaned SKILL.md and a clear explanation of why those patterns are present. Summary: the skill's stated scope is plausible, but metadata mismatches, embedded unrelated files and exposed secrets, and prompt-injection signals make this package unsafe until cleaned and the single image-generation script is independently reviewed.

Type: OpenClaw Skill Name: wenxiang-2d5-banner Version: 1.0.0 The bundle appears to be a full workspace dump rather than a focused skill, containing a massive amount of sensitive data including hardcoded API keys for Aliyun, Feishu, and other services in files such as 'openclaw.json', 'fetch_feishu_docs.py', and various test scripts. It includes high-privilege logic like the 'feishu-multi-agent-manager', which can modify the core 'openclaw.json' configuration, and 'autonomous-thinking.js', which allows the agent to rewrite its own memory and logs. While these features align with the stated goal of a 'self-improving' agent, the presence of leaked credentials and the ability to perform broad system and configuration modifications pose a significant security risk.