← 返回 Skills 市场
liujuntao123

Auto Free Banana

作者 liujuntao123 · GitHub ↗ · v1.0.0 · MIT-0
cross-platform ⚠ suspicious
273
总下载
1
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install auto-free-banana
功能描述
Generates images in Google Flow (labs.google/fx) through browser UI automation. Supports Nano Banana 2 and Nano Banana Pro with landscape/portrait aspect rat...
使用说明 (SKILL.md)

Google Flow UI Client

Generate images in Google Flow through Chrome CDP + browser UI automation.

Important constraints:

  • Project creation is UI-only
  • Prompt submission is UI-only
  • Do not use or describe any API-based project creation path
  • Images are considered complete once the base images are visible in the browser

Script Directory

Resolve:

  1. {baseDir} = directory containing this SKILL.md
  2. Script path = {baseDir}/scripts/main.ts
  3. ${BUN_X} = bun if installed, else npx -y bun

Consent Check (REQUIRED)

Before first use, verify user consent for reverse-engineered API usage.

Consent file locations:

  • macOS: ~/Library/Application Support/baoyu-skills/flow-web/consent.json
  • Linux: ~/.local/share/baoyu-skills/flow-web/consent.json
  • Windows: %APPDATA%\baoyu-skills\flow-web\consent.json

Flow:

  1. Check if consent file exists with accepted: true and disclaimerVersion: "1.0"
  2. If valid consent exists → print warning with acceptedAt date, proceed
  3. If no consent → show disclaimer, ask user via AskUserQuestion:
    • "Yes, I accept" → create consent file with ISO timestamp, proceed
    • "No, I decline" → output decline message, stop
  4. Consent file format: {"version":1,"accepted":true,"acceptedAt":"\x3CISO>","disclaimerVersion":"1.0"}

Preferences (EXTEND.md)

Check EXTEND.md existence (priority order):

test -f .baoyu-skills/auto-free-banana/EXTEND.md && echo "project"
test -f "${XDG_CONFIG_HOME:-$HOME/.config}/baoyu-skills/auto-free-banana/EXTEND.md" && echo "xdg"
test -f "$HOME/.baoyu-skills/auto-free-banana/EXTEND.md" && echo "user"

EXTEND.md Supports: Default model | Default aspect ratio | Custom data directory

Execution Envelope (REQUIRED)

Before any pre-flight check or main.ts invocation, decide one shell environment and reuse it for every command in the run.

  • Use the same PATH
  • Use the same proxy variables
  • Use the same CDP / Chrome profile variables

If you set any of these once, keep them identical for all later commands in the turn:

  • PATH
  • FLOW_WEB_PROXY
  • HTTPS_PROXY / HTTP_PROXY
  • AGENT_BROWSER_CHROME_PROXY_SERVER
  • FLOW_WEB_DEBUG_PORT / AGENT_BROWSER_CDP_PORT
  • FLOW_WEB_COOKIE_PATH
  • FLOW_WEB_CHROME_PROFILE_DIR
  • AGENT_BROWSER_USER_DATA_DIR_WIN
  • AGENT_BROWSER_CMD_EXE_WSL

Never run pre-flight checks in one environment and main.ts in another.

Preferred proxy setup:

export FLOW_WEB_PROXY=http://host:port
export HTTPS_PROXY="$FLOW_WEB_PROXY"
export HTTP_PROXY="$FLOW_WEB_PROXY"
export AGENT_BROWSER_CHROME_PROXY_SERVER="$FLOW_WEB_PROXY"

Usage

Before running any generation command, complete the Pre-flight Checks below.

# Default generation: creates a NEW Flow project through the UI
${BUN_X} {baseDir}/scripts/main.ts --prompt "A cute cat"

# Specify model + portrait + 2 images
${BUN_X} {baseDir}/scripts/main.ts --prompt "A sunset" --model NANO_BANANA_PRO --aspect 9:16 --count 2

# Reuse an EXISTING Flow project only when you already have the project id
${BUN_X} {baseDir}/scripts/main.ts --project-id \x3Cproject-id> --prompt "A sunset"

# Authentication only
${BUN_X} {baseDir}/scripts/main.ts --login

# Batch mode: multiple prompts in one project (5s interval)
${BUN_X} {baseDir}/scripts/main.ts --prompt "A cute cat" --prompt "A sunset" --prompt "A mountain landscape"

Batch mode rules:

  • Use one command with repeated --prompt
  • The first prompt creates a new project through the UI unless --project-id is supplied
  • Later prompts reuse that same project
  • Do not run multiple separate main.ts commands for a multi-prompt batch

Pre-flight Checks

Run these checks in order. Each step must pass before moving to the next.

Step 1: Runtime Prerequisites (BLOCKING)

Check the Bun runtime and Python:

command -v bun >/dev/null && echo "BUN" || command -v npx >/dev/null && echo "NPX_BUN" || echo "MISSING"
command -v python3 >/dev/null && echo "OK" || echo "MISSING"

If any required command is missing, stop.

If running under WSL, also verify the Windows bridge and Chrome path assumptions:

test -x /mnt/c/Windows/System32/cmd.exe && echo "OK" || echo "MISSING"
test -f "/mnt/c/Program Files/Google/Chrome/Application/chrome.exe" && echo "OK" || echo "MISSING"

If not running under WSL, ensure FLOW_WEB_CHROME_PATH is set before continuing.

Step 2: Browser Profile Check (AUTO-RESOLVE)

Check if the Chrome debug user data directory exists. Default WSL-visible path:

  • /mnt/c/chrome-debug-openclaw
  • env override: AGENT_BROWSER_USER_DATA_DIR_WIN
test -d /mnt/c/chrome-debug-openclaw && echo "EXISTS" || echo "NEW"
  • EXISTS → proceed
  • NEW → proceed, but tell the user a fresh browser profile will be created

Step 3: Network Connectivity Check (WARN + WAIT)

Test Google reachability using the same environment you will use for main.ts:

curl -sS --connect-timeout 5 -o /dev/null -w '%{http_code}' https://labs.google/fx/ 2>/dev/null || echo "FAIL"
  • 200/301/302 → proceed
  • FAIL / timeout → stop and fix proxy settings first

Do not continue into main.ts while shell networking and browser proxy settings disagree.

Step 4: Login State Check (WARN + GUIDE)

Check if cached credentials exist:

Linux default cookie file:

  • ~/.local/share/baoyu-skills/flow-web/cookies.json
test -f ~/.local/share/baoyu-skills/flow-web/cookies.json && echo "EXISTS" || echo "NONE"
  • EXISTS → proceed
  • NONE → run:
    ${BUN_X} {baseDir}/scripts/main.ts --login --verbose
    
    Then wait for the user to finish Google login in the browser.

Generation Rules

The skill supports exactly two generation entry modes:

  • New project: omit --project-id; the script creates a project through the Flow UI
  • Existing project: provide --project-id

Do not invent any third path.

Explicitly forbidden:

  • API-based project creation
  • Describing API project creation as a fallback
  • Mixing one failed path with a different project-creation mechanism mid-run

If automatic UI project creation fails:

  1. Inspect the Flow listing page in the browser
  2. Fix the UI state only
  3. Retry the same UI path
  4. If needed, manually click 新建项目 in the browser, capture the resulting project id from the URL, then rerun main.ts with --project-id \x3Cid>

The fallback is still UI-only.


Task Completion (IMPORTANT)

main.ts only automates the UI. It fills the prompt, clicks Create, then exits immediately. Actual image generation continues asynchronously in the browser.

After main.ts exits with code 0:

  1. The script has successfully submitted all prompts. Images are now generating in the browser.
  2. You MUST verify generation completion by taking a browser screenshot (via CDP or screenshot tool) and visually checking whether images have appeared on the page.
  3. If the screenshot shows images are still loading (spinner, progress indicator, blank placeholders), wait 10-15 seconds and take another screenshot.
  4. Repeat until all images are visible, or until 2 minutes have passed (then report a timeout).
  5. Once the base images are confirmed visible, stop and report completion.
  6. Do NOT download, fetch, curl, or render any URLs. Images are visible in the browser.

Important completion rule:

  • If the images are visible and Flow still shows optional HD-enhancement / download / post-processing toasts, treat the task as complete anyway.

If the script exits with a non-zero code, report the error and stop.


Options

Option Description
--prompt, -p Prompt text (repeat for batch mode)
--model, -m Model ID (see Models table)
--aspect, -a Aspect ratio: 16:9 (default), 9:16
--count Number of images: 1-4 (default: 2)
--project-id Reuse existing project
--verbose Enable debug logging
--login Authenticate and save cookies, then exit
--cookie-path Custom cookie file path
--profile-dir Chrome profile directory

Models

Model Description
NARWHAL Nano Banana 2 (default, fast)
NANO_BANANA_PRO Nano Banana Pro

Optional Verification Helper

If /home/admin1/.openclaw/workspace/scripts/agent-browser-cdp.sh exists, it is a convenient helper for screenshots and browser inspection after generation:

bash /home/admin1/.openclaw/workspace/scripts/agent-browser-cdp.sh --full screenshot /tmp/flow.png
bash /home/admin1/.openclaw/workspace/scripts/agent-browser-cdp.sh snapshot -c

This helper is optional. Generation must not depend on agent-browser being installed.

Environment Variables

Variable Description
FLOW_WEB_PROXY Preferred proxy for shell/API requests
HTTPS_PROXY / HTTP_PROXY Standard proxy env vars
FLOW_WEB_DATA_DIR Data directory
FLOW_WEB_COOKIE_PATH Cookie file path
FLOW_WEB_CHROME_PROFILE_DIR Local Chrome user data dir when not on WSL
FLOW_WEB_CHROME_PATH Chrome executable path for non-WSL environments
FLOW_WEB_DEBUG_PORT Fixed Chrome debug port
FLOW_WEB_CHROME_EXE_WIN Windows Chrome path override when running from WSL
FLOW_WEB_CHROME_USER_DATA_DIR_WIN Windows Chrome user data dir override when running from WSL
FLOW_WEB_CHROME_EXTRA_ARGS Extra Chrome args
AGENT_BROWSER_CHROME_PROXY_SERVER Browser proxy used by host Chrome
AGENT_BROWSER_USER_DATA_DIR_WIN Windows-side Chrome debug profile override
AGENT_BROWSER_CMD_EXE_WSL WSL path to cmd.exe
BAOYU_CHROME_PROFILE_DIR Shared Chrome profile override
安全使用建议
This skill performs browser UI automation and will read your Chrome profile and cookies, extract Flow OAuth tokens (accessToken starting with 'ya29.'), and save them to a cookies.json under your user app-data directory. That behavior is required for UI-based authentication but is sensitive. Before installing: 1) Inspect the repository/source (homepage) and confirm you trust it. 2) Be prepared to give explicit consent (the skill also creates a consent.json). 3) Prefer running it with an isolated Chrome profile (not your primary, especially on shared machines) or set FLOW_WEB_CHROME_PROFILE_DIR to a disposable profile. 4) If you’re uncomfortable with persistent tokens, avoid reuse or delete the cookie file after use. 5) Ensure you only run this on a machine where starting Chrome via the debug port and the WSL/Windows bridge (if applicable) is acceptable. If you want higher assurance, ask the maintainer for a signed release or run the code in an isolated environment first.
功能分析
Type: OpenClaw Skill Name: auto-free-banana Version: 1.0.0 The skill automates Google Flow image generation via Chrome DevTools Protocol (CDP) but contains significant security risks. It features a shell injection vulnerability in `scripts/flow-webapi/utils/paths.ts` where `execSync` is called on unsanitized environment variables. Additionally, it performs high-risk credential handling by launching Chrome with remote debugging enabled, scraping OAuth tokens (ya29.*) from the browser session, and storing them in a local `cookies.json` file. While these behaviors appear aligned with the stated purpose of UI automation, the lack of input sanitization and the handling of sensitive session data meet the threshold for a suspicious classification.
能力评估
Purpose & Capability
The skill automates Chrome via CDP, extracts Flow session tokens/cookies, creates Flow projects through the UI, and submits prompts. Those capabilities align with the stated goal of UI-based Google Flow image generation. Access to a Chrome profile and cookies is necessary for this approach.
Instruction Scope
SKILL.md explicitly instructs reading/writing consent and cookie files, manipulating a Chrome user-data directory, launching Chrome (including via WSL/cmd.exe) and using consistent proxy/env settings. This stays within the described automation scope but does require reading browser state and writing persistent files in the user's home/config paths.
Install Mechanism
There is no external download/install spec; execution is expected via bun or npx (declared). All code is bundled in the skill. No remote archives, package installs from untrusted URLs, or URL shorteners are used.
Credentials
The skill does not request unrelated cloud credentials, but it does extract and persist OAuth access tokens (ya29.*) and browser cookies to a cookies.json in the user's app-data dir and uses many env overrides (FLOW_WEB_*, AGENT_BROWSER_*). Those are sensitive but functionally required for UI-based auth and session reuse. Users should be aware tokens are stored on disk.
Persistence & Privilege
The skill is not always-enabled and does not request system-wide privileges. It writes/reads its own consent and cookie files within user data directories and may create or reuse a Chrome profile; this persistence is consistent with its function.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install auto-free-banana
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /auto-free-banana 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.0.0
Publish auto-free-banana
元数据
Slug auto-free-banana
版本 1.0.0
许可证 MIT-0
累计安装 0
当前安装数 0
历史版本数 1
常见问题

Auto Free Banana 是什么?

Generates images in Google Flow (labs.google/fx) through browser UI automation. Supports Nano Banana 2 and Nano Banana Pro with landscape/portrait aspect rat... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 273 次。

如何安装 Auto Free Banana?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install auto-free-banana」即可一键安装,无需额外配置。

Auto Free Banana 是免费的吗?

是的,Auto Free Banana 完全免费,采用 MIT-0 许可证,可自由下载、安装和使用。

Auto Free Banana 支持哪些平台?

Auto Free Banana 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 Auto Free Banana?

由 liujuntao123(@liujuntao123)开发并维护,当前版本 v1.0.0。

💬 留言讨论