Wavespeed Nanobanana2

调用Wavespeed AI的NanoBanana-2模型实现文生图、图生图的专业图像创作技能

Do not install or enable this skill until the issues are fixed. Specific actions to take or request from the author: - Remove the top-level test block (the anonymous async function at the end of index.js). That code runs on module load and triggers an outbound API call immediately. - Remove any hardcoded API key from the repository. If the embedded key is real, revoke it immediately (treat it as compromised). - Fix registry metadata and SKILL.md to consistently declare WAVESPEED_API_KEY as a required environment variable. - Implement or document the advertised parameters (resolution, output_format) or update SKILL.md to match the actual behavior. - Replace the malformed skill.json (which contains a shell echo command) with a proper JSON file — shipping a shell command as the skill manifest is suspicious and could modify user files if executed by a maintainer script. - After the author provides a cleaned version, review that no secrets remain in code and that no code runs network calls on import; run the skill in an isolated environment first to confirm behavior and any billing implications. If you cannot get a corrected package, treat this skill as untrusted because of embedded secrets and load-time network activity.

Type: OpenClaw Skill Name: wavespeed-nanobanana2 Version: 1.0.3 The skill bundle contains a hardcoded API key in a test block within `index.js`, which constitutes a significant credential leak vulnerability. Additionally, `index.js` includes an Immediately Invoked Function Expression (IIFE) that executes a network request to `api.wavespeed.ai` automatically upon module load, which is unexpected behavior for a skill. Furthermore, the `skill.json` file is provided as a shell command (`echo ... > path`) rather than raw JSON, which could be used to trick an automated agent into executing unauthorized filesystem operations.