Nano Banana Image T8

提供 Nano Banana API Key 和提示词，支持文生图与图生图（至少一张图片），可选尺寸比例，默认模型为香蕉2。

This skill appears to implement the stated image-generation functionality, but there are several things to check before installing or using it with real keys: - The skill will persist your Nano Banana API key to ~/.whaleclaw/credentials/nano_banana_api_key.txt (file mode 600) and will reuse it automatically. If you do not want keys stored on disk, do not allow the skill to save the key or delete the file after use. - The registry metadata lists no required env vars or config paths, yet the skill reads NANO_BANANA_API_KEY and writes credential and default-model files; this mismatch is an incoherence you should ask the publisher to explain. - The script sends requests to https://ai.t8star.cn by default. Confirm that this endpoint is the intended/trusted backend for the Nano Banana service before sending secrets. - The script maps public model names to internal identifiers (e.g., '香蕉2' → 'gemini-3.1-flash-image-preview'), which is unusual; ask the author to document these mappings and provenance of the backend models. - There is no install step for Python deps (httpx). Ensure you run the script in an isolated environment and inspect the script fully before executing it with a real key. If you want to proceed: (1) inspect the full script locally, (2) run it in a sandbox or restricted environment, (3) avoid letting the skill auto-save your API key (or remove it immediately after testing), and (4) verify the external host/endpoint is legitimate. If the publisher cannot explain the metadata/file-path mismatches and the model mapping, treat the skill with caution.

Type: OpenClaw Skill Name: nano-banana-image-t8-mac Version: 0.1.8 The skill bundle is a legitimate tool for interacting with the Nano Banana image generation API (ai.t8star.cn). The Python script (test_nano_banana_2.py) handles API keys securely by saving them with restricted file permissions (0600) and only communicates with the designated API endpoint. The instructions in SKILL.md include defensive prompts that explicitly forbid the agent from scanning for keys in unrelated directories or using unauthorized execution methods like curl or file_write.