Nano Triple

3 images, one prompt, instant A/B/C. Nano Banana Pro's natural randomness gives you three distinct takes on any image idea — generated in parallel. Pick the...

This skill's instructions run a script from ~/.npm-global and say they will use GEMINI_API_KEY, but the skill metadata does not declare those requirements. Before installing or enabling: (1) Verify the referenced repository/package (https://github.com/mvanhorn/nano-triple and the nano-banana-pro package) and inspect the generate_image.py script for what it does; (2) Confirm you have and trust the 'uv' runner and any npm package at ~/.npm-global — running files from your home directory can execute arbitrary code; (3) Only provide a GEMINI_API_KEY if you trust the implementation and know where requests will be sent; (4) If you cannot inspect the external script or do not trust the package source, do not enable this skill. Asking the skill author to declare required env vars, binaries, and the exact network endpoints would resolve the main concerns.

Type: OpenClaw Skill Name: nano-triple Version: 1.2.0 The skill bundle contains a significant command injection vulnerability in SKILL.md. It instructs the AI agent to execute a shell command using `uv run` while passing the user's raw, unvalidated input directly into the `--prompt` argument. While the stated goal of parallel image generation is plausible, this pattern allows for remote code execution (RCE) if a user provides a crafted prompt containing shell metacharacters (e.g., backticks or semicolons).