← Back to Skills Marketplace
liujuntao123

Auto Free Banana

by liujuntao123 · GitHub ↗ · v1.0.0 · MIT-0
cross-platform ⚠ suspicious
273
Downloads
1
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install auto-free-banana
Description
Generates images in Google Flow (labs.google/fx) through browser UI automation. Supports Nano Banana 2 and Nano Banana Pro with landscape/portrait aspect rat...
README (SKILL.md)

Google Flow UI Client

Generate images in Google Flow through Chrome CDP + browser UI automation.

Important constraints:

  • Project creation is UI-only
  • Prompt submission is UI-only
  • Do not use or describe any API-based project creation path
  • Images are considered complete once the base images are visible in the browser

Script Directory

Resolve:

  1. {baseDir} = directory containing this SKILL.md
  2. Script path = {baseDir}/scripts/main.ts
  3. ${BUN_X} = bun if installed, else npx -y bun

Consent Check (REQUIRED)

Before first use, verify user consent for reverse-engineered API usage.

Consent file locations:

  • macOS: ~/Library/Application Support/baoyu-skills/flow-web/consent.json
  • Linux: ~/.local/share/baoyu-skills/flow-web/consent.json
  • Windows: %APPDATA%\baoyu-skills\flow-web\consent.json

Flow:

  1. Check if consent file exists with accepted: true and disclaimerVersion: "1.0"
  2. If valid consent exists → print warning with acceptedAt date, proceed
  3. If no consent → show disclaimer, ask user via AskUserQuestion:
    • "Yes, I accept" → create consent file with ISO timestamp, proceed
    • "No, I decline" → output decline message, stop
  4. Consent file format: {"version":1,"accepted":true,"acceptedAt":"\x3CISO>","disclaimerVersion":"1.0"}

Preferences (EXTEND.md)

Check EXTEND.md existence (priority order):

test -f .baoyu-skills/auto-free-banana/EXTEND.md && echo "project"
test -f "${XDG_CONFIG_HOME:-$HOME/.config}/baoyu-skills/auto-free-banana/EXTEND.md" && echo "xdg"
test -f "$HOME/.baoyu-skills/auto-free-banana/EXTEND.md" && echo "user"

EXTEND.md Supports: Default model | Default aspect ratio | Custom data directory

Execution Envelope (REQUIRED)

Before any pre-flight check or main.ts invocation, decide one shell environment and reuse it for every command in the run.

  • Use the same PATH
  • Use the same proxy variables
  • Use the same CDP / Chrome profile variables

If you set any of these once, keep them identical for all later commands in the turn:

  • PATH
  • FLOW_WEB_PROXY
  • HTTPS_PROXY / HTTP_PROXY
  • AGENT_BROWSER_CHROME_PROXY_SERVER
  • FLOW_WEB_DEBUG_PORT / AGENT_BROWSER_CDP_PORT
  • FLOW_WEB_COOKIE_PATH
  • FLOW_WEB_CHROME_PROFILE_DIR
  • AGENT_BROWSER_USER_DATA_DIR_WIN
  • AGENT_BROWSER_CMD_EXE_WSL

Never run pre-flight checks in one environment and main.ts in another.

Preferred proxy setup:

export FLOW_WEB_PROXY=http://host:port
export HTTPS_PROXY="$FLOW_WEB_PROXY"
export HTTP_PROXY="$FLOW_WEB_PROXY"
export AGENT_BROWSER_CHROME_PROXY_SERVER="$FLOW_WEB_PROXY"

Usage

Before running any generation command, complete the Pre-flight Checks below.

# Default generation: creates a NEW Flow project through the UI
${BUN_X} {baseDir}/scripts/main.ts --prompt "A cute cat"

# Specify model + portrait + 2 images
${BUN_X} {baseDir}/scripts/main.ts --prompt "A sunset" --model NANO_BANANA_PRO --aspect 9:16 --count 2

# Reuse an EXISTING Flow project only when you already have the project id
${BUN_X} {baseDir}/scripts/main.ts --project-id \x3Cproject-id> --prompt "A sunset"

# Authentication only
${BUN_X} {baseDir}/scripts/main.ts --login

# Batch mode: multiple prompts in one project (5s interval)
${BUN_X} {baseDir}/scripts/main.ts --prompt "A cute cat" --prompt "A sunset" --prompt "A mountain landscape"

Batch mode rules:

  • Use one command with repeated --prompt
  • The first prompt creates a new project through the UI unless --project-id is supplied
  • Later prompts reuse that same project
  • Do not run multiple separate main.ts commands for a multi-prompt batch

Pre-flight Checks

Run these checks in order. Each step must pass before moving to the next.

Step 1: Runtime Prerequisites (BLOCKING)

Check the Bun runtime and Python:

command -v bun >/dev/null && echo "BUN" || command -v npx >/dev/null && echo "NPX_BUN" || echo "MISSING"
command -v python3 >/dev/null && echo "OK" || echo "MISSING"

If any required command is missing, stop.

If running under WSL, also verify the Windows bridge and Chrome path assumptions:

test -x /mnt/c/Windows/System32/cmd.exe && echo "OK" || echo "MISSING"
test -f "/mnt/c/Program Files/Google/Chrome/Application/chrome.exe" && echo "OK" || echo "MISSING"

If not running under WSL, ensure FLOW_WEB_CHROME_PATH is set before continuing.

Step 2: Browser Profile Check (AUTO-RESOLVE)

Check if the Chrome debug user data directory exists. Default WSL-visible path:

  • /mnt/c/chrome-debug-openclaw
  • env override: AGENT_BROWSER_USER_DATA_DIR_WIN
test -d /mnt/c/chrome-debug-openclaw && echo "EXISTS" || echo "NEW"
  • EXISTS → proceed
  • NEW → proceed, but tell the user a fresh browser profile will be created

Step 3: Network Connectivity Check (WARN + WAIT)

Test Google reachability using the same environment you will use for main.ts:

curl -sS --connect-timeout 5 -o /dev/null -w '%{http_code}' https://labs.google/fx/ 2>/dev/null || echo "FAIL"
  • 200/301/302 → proceed
  • FAIL / timeout → stop and fix proxy settings first

Do not continue into main.ts while shell networking and browser proxy settings disagree.

Step 4: Login State Check (WARN + GUIDE)

Check if cached credentials exist:

Linux default cookie file:

  • ~/.local/share/baoyu-skills/flow-web/cookies.json
test -f ~/.local/share/baoyu-skills/flow-web/cookies.json && echo "EXISTS" || echo "NONE"
  • EXISTS → proceed
  • NONE → run:
    ${BUN_X} {baseDir}/scripts/main.ts --login --verbose
    
    Then wait for the user to finish Google login in the browser.

Generation Rules

The skill supports exactly two generation entry modes:

  • New project: omit --project-id; the script creates a project through the Flow UI
  • Existing project: provide --project-id

Do not invent any third path.

Explicitly forbidden:

  • API-based project creation
  • Describing API project creation as a fallback
  • Mixing one failed path with a different project-creation mechanism mid-run

If automatic UI project creation fails:

  1. Inspect the Flow listing page in the browser
  2. Fix the UI state only
  3. Retry the same UI path
  4. If needed, manually click 新建项目 in the browser, capture the resulting project id from the URL, then rerun main.ts with --project-id \x3Cid>

The fallback is still UI-only.


Task Completion (IMPORTANT)

main.ts only automates the UI. It fills the prompt, clicks Create, then exits immediately. Actual image generation continues asynchronously in the browser.

After main.ts exits with code 0:

  1. The script has successfully submitted all prompts. Images are now generating in the browser.
  2. You MUST verify generation completion by taking a browser screenshot (via CDP or screenshot tool) and visually checking whether images have appeared on the page.
  3. If the screenshot shows images are still loading (spinner, progress indicator, blank placeholders), wait 10-15 seconds and take another screenshot.
  4. Repeat until all images are visible, or until 2 minutes have passed (then report a timeout).
  5. Once the base images are confirmed visible, stop and report completion.
  6. Do NOT download, fetch, curl, or render any URLs. Images are visible in the browser.

Important completion rule:

  • If the images are visible and Flow still shows optional HD-enhancement / download / post-processing toasts, treat the task as complete anyway.

If the script exits with a non-zero code, report the error and stop.


Options

Option Description
--prompt, -p Prompt text (repeat for batch mode)
--model, -m Model ID (see Models table)
--aspect, -a Aspect ratio: 16:9 (default), 9:16
--count Number of images: 1-4 (default: 2)
--project-id Reuse existing project
--verbose Enable debug logging
--login Authenticate and save cookies, then exit
--cookie-path Custom cookie file path
--profile-dir Chrome profile directory

Models

Model Description
NARWHAL Nano Banana 2 (default, fast)
NANO_BANANA_PRO Nano Banana Pro

Optional Verification Helper

If /home/admin1/.openclaw/workspace/scripts/agent-browser-cdp.sh exists, it is a convenient helper for screenshots and browser inspection after generation:

bash /home/admin1/.openclaw/workspace/scripts/agent-browser-cdp.sh --full screenshot /tmp/flow.png
bash /home/admin1/.openclaw/workspace/scripts/agent-browser-cdp.sh snapshot -c

This helper is optional. Generation must not depend on agent-browser being installed.

Environment Variables

Variable Description
FLOW_WEB_PROXY Preferred proxy for shell/API requests
HTTPS_PROXY / HTTP_PROXY Standard proxy env vars
FLOW_WEB_DATA_DIR Data directory
FLOW_WEB_COOKIE_PATH Cookie file path
FLOW_WEB_CHROME_PROFILE_DIR Local Chrome user data dir when not on WSL
FLOW_WEB_CHROME_PATH Chrome executable path for non-WSL environments
FLOW_WEB_DEBUG_PORT Fixed Chrome debug port
FLOW_WEB_CHROME_EXE_WIN Windows Chrome path override when running from WSL
FLOW_WEB_CHROME_USER_DATA_DIR_WIN Windows Chrome user data dir override when running from WSL
FLOW_WEB_CHROME_EXTRA_ARGS Extra Chrome args
AGENT_BROWSER_CHROME_PROXY_SERVER Browser proxy used by host Chrome
AGENT_BROWSER_USER_DATA_DIR_WIN Windows-side Chrome debug profile override
AGENT_BROWSER_CMD_EXE_WSL WSL path to cmd.exe
BAOYU_CHROME_PROFILE_DIR Shared Chrome profile override
Usage Guidance
This skill performs browser UI automation and will read your Chrome profile and cookies, extract Flow OAuth tokens (accessToken starting with 'ya29.'), and save them to a cookies.json under your user app-data directory. That behavior is required for UI-based authentication but is sensitive. Before installing: 1) Inspect the repository/source (homepage) and confirm you trust it. 2) Be prepared to give explicit consent (the skill also creates a consent.json). 3) Prefer running it with an isolated Chrome profile (not your primary, especially on shared machines) or set FLOW_WEB_CHROME_PROFILE_DIR to a disposable profile. 4) If you’re uncomfortable with persistent tokens, avoid reuse or delete the cookie file after use. 5) Ensure you only run this on a machine where starting Chrome via the debug port and the WSL/Windows bridge (if applicable) is acceptable. If you want higher assurance, ask the maintainer for a signed release or run the code in an isolated environment first.
Capability Analysis
Type: OpenClaw Skill Name: auto-free-banana Version: 1.0.0 The skill automates Google Flow image generation via Chrome DevTools Protocol (CDP) but contains significant security risks. It features a shell injection vulnerability in `scripts/flow-webapi/utils/paths.ts` where `execSync` is called on unsanitized environment variables. Additionally, it performs high-risk credential handling by launching Chrome with remote debugging enabled, scraping OAuth tokens (ya29.*) from the browser session, and storing them in a local `cookies.json` file. While these behaviors appear aligned with the stated purpose of UI automation, the lack of input sanitization and the handling of sensitive session data meet the threshold for a suspicious classification.
Capability Assessment
Purpose & Capability
The skill automates Chrome via CDP, extracts Flow session tokens/cookies, creates Flow projects through the UI, and submits prompts. Those capabilities align with the stated goal of UI-based Google Flow image generation. Access to a Chrome profile and cookies is necessary for this approach.
Instruction Scope
SKILL.md explicitly instructs reading/writing consent and cookie files, manipulating a Chrome user-data directory, launching Chrome (including via WSL/cmd.exe) and using consistent proxy/env settings. This stays within the described automation scope but does require reading browser state and writing persistent files in the user's home/config paths.
Install Mechanism
There is no external download/install spec; execution is expected via bun or npx (declared). All code is bundled in the skill. No remote archives, package installs from untrusted URLs, or URL shorteners are used.
Credentials
The skill does not request unrelated cloud credentials, but it does extract and persist OAuth access tokens (ya29.*) and browser cookies to a cookies.json in the user's app-data dir and uses many env overrides (FLOW_WEB_*, AGENT_BROWSER_*). Those are sensitive but functionally required for UI-based auth and session reuse. Users should be aware tokens are stored on disk.
Persistence & Privilege
The skill is not always-enabled and does not request system-wide privileges. It writes/reads its own consent and cookie files within user data directories and may create or reuse a Chrome profile; this persistence is consistent with its function.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install auto-free-banana
  3. After installation, invoke the skill by name or use /auto-free-banana
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Publish auto-free-banana
Metadata
Slug auto-free-banana
Version 1.0.0
License MIT-0
All-time Installs 0
Active Installs 0
Total Versions 1
Frequently Asked Questions

What is Auto Free Banana?

Generates images in Google Flow (labs.google/fx) through browser UI automation. Supports Nano Banana 2 and Nano Banana Pro with landscape/portrait aspect rat... It is an AI Agent Skill for Claude Code / OpenClaw, with 273 downloads so far.

How do I install Auto Free Banana?

Run "/install auto-free-banana" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Auto Free Banana free?

Yes, Auto Free Banana is completely free, licensed under MIT-0. You can download, install and use it at no cost.

Which platforms does Auto Free Banana support?

Auto Free Banana is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Auto Free Banana?

It is built and maintained by liujuntao123 (@liujuntao123); the current version is v1.0.0.

💬 Comments