Nano Banana Image T8

通过Nano Banana API完成文本生成图像和图像编辑，支持上传图片和自定义尺寸比例的生图测试和联调。

This skill is mostly coherent with its stated purpose but contains a few things to review before installing or using it with real credentials: - The script will save any provided API key to ~/.whaleclaw/credentials/nano_banana_api_key.txt (mode 600). If you allow the skill to store a key, be prepared to rotate it if you later uninstall the skill. - The script follows image URLs returned by the API and performs HTTP GET on them. If the http client includes your Authorization header when fetching those URLs, your API key could be leaked to whatever host is referenced in the response (third-party CDN or an internal IP). Ask the maintainer or inspect/patch the script so that requests to image URLs do not include the Authorization header (or validate/whitelist hosts before fetching). - SKILL.md forbids changing the base URL but the script accepts a --base-url argument; decide whether you trust the script caller to adhere to the policy. An attacker or misconfiguration could point --base-url to a different host. - The script's internal default model string (e.g., gemini-3.1-flash-image-preview) differs from the external display names in the SKILL.md. That is likely benign but worth noting if you care about model-identifiers being revealed. - Registry metadata lists no required env vars but the skill expects an API key param mapped to NANO_BANANA_API_KEY — this metadata mismatch may affect automated tooling. Confirm how your agent platform will surface the API key prompt and where the key will be stored. If you decide to use it: inspect the script (or request a change) so that (1) when fetching image URLs it strips Authorization and other sensitive headers, (2) it validates/whitelists hosts for external fetches, and (3) behavior around default model display vs internal identifiers is explicit. If you cannot inspect or modify the script, consider using a throwaway/limited-scope API key.

Type: OpenClaw Skill Name: nano-banana-image-t8 Version: 0.1.5 The skill bundle provides a legitimate interface for image generation and editing via the Nano Banana API (ai.t8star.cn). The included Python script (test_nano_banana_2.py) manages API keys and user preferences by storing them in the user's home directory with appropriate file permissions (chmod 600). The instructions in SKILL.md are detailed and include specific privacy safeguards, such as instructing the AI agent to only capture API keys when explicitly used for this service and to avoid scanning unrelated files. No evidence of data exfiltration, unauthorized execution, or malicious intent was found.