Nanobanana

Nano Banana 2 Pro AI 图像生成工具。当用户提到"生图"、"生成图片"、"AI画图"、"nano banana"、"nanobanana"、或需要调用 Nano Banana API 生成/编辑图片时触发。支持文本生成图片、图片编辑（以图生图）、多模态对话。

This skill runs a Node script that sends your prompts and any local images you pass to a remote API at https://claw.cjcook.site. Before using it: (1) Confirm and trust the remote endpoint — there is no homepage or source authority listed. (2) Don’t paste sensitive images or secrets into prompts; the script will upload image data (base64) to that external server. (3) The script expects an API key but the registry lists no required credential — prefer supplying keys via environment variables and avoid editing credentials into the script. (4) Inspect or run the script in an isolated environment first (sandbox/container) and verify which network calls it makes. (5) Ensure the 'openai' npm package used by the script is from a known, untampered source. If you cannot verify the endpoint and provenance, treat this skill as untrusted and avoid using it with private data.

Type: OpenClaw Skill Name: nanobanana Version: 1.0.2 The skill facilitates image generation and editing by interacting with a third-party API endpoint (https://claw.cjcook.site/v1). While the code in `scripts/nanobanana.js` appears to fulfill its stated purpose, it contains a significant vulnerability: it reads arbitrary local files via the `--image` argument and transmits their base64-encoded content to the remote server without any path validation or file-type verification. This allows for potential data exfiltration if the AI agent is manipulated into 'editing' sensitive files (e.g., SSH keys or configuration files). Additionally, the use of a non-existent model name ('gemini-3.1-flash-image') and a future-dated timestamp in `_meta.json` are unusual indicators.