Nano Banana

Reasoning-driven image generation using structured creative briefs (Gemini 3 style) — generates high-fidelity images via muapi.ai with logic-based prompting

This skill is a wrapper that rewrites prompts and then calls a platform 'core/media/generate-image.sh' primitive. Before installing, verify: (1) where the muapi.ai/network call actually happens — inspect core/media/generate-image.sh on your host to confirm which service and credentials it uses; (2) that any API keys required for muapi.ai are stored and managed by the platform (not expected from this skill); (3) that you trust the platform primitive invoked by the relative path (the script executes a file outside the skill directory); and (4) whether the model name 'nano-banana-pro' maps to an internal/private model or an external API. If you cannot inspect the host primitive or confirm credential handling, treat the credential-service mismatch as a risk and do not enable the skill for autonomous invocation.

Type: OpenClaw Skill Name: muapi-nano-banana-skill Version: 0.1.0 The skill contains a critical shell injection vulnerability in `scripts/generate-nano-art.sh`. User-provided arguments (such as `--subject` and `--action`) are placed directly into a double-quoted string during variable assignment, which allows for arbitrary command expansion and execution (RCE) if an attacker provides crafted input like `$(command)`. While the logic aligns with the stated goal of 'reasoning-driven image generation,' the lack of input sanitization in the bash script presents a significant security risk.