WaveSpeedAI Nano Banana Pro Image Generation/Editing

Generate and edit images using Google's Nano Banana Pro model via WaveSpeed AI. Supports text-to-image generation and image editing with natural language pro...

This skill appears to be a straightforward WaveSpeed client wrapper for an image model, but the SKILL.md and the registry disagree: the documentation requires a WAVESPEED_API_KEY and describes uploading local files, yet the skill metadata declares no environment variables or primary credential and there is no source/homepage listed. Before installing: (1) confirm the WAVESPEED_API_KEY requirement — expect to supply that key if you use the skill; (2) verify the skill's provenance (author, homepage, or source repo) — avoid keys if you don't trust the publisher; (3) if you will upload local images, be aware the agent will need access to those file paths and the images will be transmitted to wavespeed.ai; (4) prefer skills whose metadata explicitly declares required credentials and includes a verifiable homepage or source; (5) consider testing in an isolated environment or with non-sensitive sample images and a scoped API key. If the publisher updates the metadata to declare WAVESPEED_API_KEY and provides a reputable source/homepage, the inconsistency would be resolved and my assessment could change to benign.

Type: OpenClaw Skill Name: wavespeed-nano-banana-pro Version: 1.0.0 The skill bundle is benign. It provides clear instructions and examples for using the WaveSpeed AI platform for image generation and editing. Crucially, the `SKILL.md` includes a 'Security Constraints' section that explicitly warns against arbitrary URL loading from untrusted sources, emphasizes API key security, and advises input validation. While the skill describes capabilities that could be misused if an agent's implementation is flawed (e.g., `wavespeed.upload()` with unvalidated paths or `images` parameter with unvalidated URLs), the skill itself actively guides against such vulnerabilities, demonstrating a responsible approach rather than malicious intent.