Nano Banana Prompting Skill

Transform natural language image requests into optimized structured prompts for Gemini image generation. Automatically detects style and builds the perfect p...

This skill appears to do what it says: produce structured Gemini prompts and run a local image generator. Before installing or using it, verify two things: (1) the provenance and behavior of the external generator it calls (nano-banana-pro/scripts/generate_image.py) — inspect that script so you know what it sends to the network and what it writes to disk; (2) the 'uv' binary requirement — confirm which tool 'uv' refers to in your environment and that it's trusted. Also limit the GEMINI_API_KEY permissions if possible and be comfortable with images being saved to your Desktop. If you cannot inspect the external generator, treat the dependency as an untrusted executable and avoid running it.

Type: OpenClaw Skill Name: nano-banana-prompting Version: 1.0.1 The skill instructs the AI agent to execute a local Python script (`generate_image.py`) with arguments, including a `--filename` argument. The `SKILL.md` file contains an explicit 'Security Note' warning the agent: 'Never pass unsanitized user input directly as the filename.' While this warning demonstrates developer awareness and an attempt to mitigate risk, it highlights a potential command injection or path traversal vulnerability if the agent fails to sanitize user input or if the external `generate_image.py` script (which is not part of this bundle) is vulnerable. This constitutes a risky capability that could lead to an RCE, classifying the skill as suspicious rather than benign, despite the lack of clear malicious intent within the provided files.