Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

grsai nano-banana 生图技能

v1.0.0

使用 grsai 平台的 nano-banana 模型生成图片(支持文生图、图生图)

0· 349·0 current·1 all-time
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description (generate images with grsai nano-banana) align with the included script and instructions. The skill declares required binaries uv and curl — uv is used to run the Python script and curl is used in examples (not in the script). However metadata lists a primary credential named "G RSAI_API_KEY" (contains a space) which does not match common env var naming conventions and differs from other locations where the API key is described (openclaw.json or --api-key CLI flag). These naming mismatches are likely typos but are incoherent and should be corrected.
Instruction Scope
SKILL.md and generate.py restrict actions to: submitting tasks to a grsai API, polling results, and downloading images to a local ./generated/ directory. There are no instructions to read unrelated local files, harvest other environment variables, or transmit arbitrary local data. The agent instructions do show curl examples and advise storing API key in openclaw.json or an environment variable.
Install Mechanism
No install spec is provided (instruction-only with a python script included). That is low-risk. The Python script depends on the 'requests' package; the script prints a helpful message if requests is missing. No remote download or archive extraction is performed by the skill itself.
!
Credentials
The only credential needed is an API key for grsai, which is proportionate. However the declared primaryEnv name "G RSAI_API_KEY" contains a space and likely is a mistake; SKILL.md also shows using an openclaw.json entry and an environment variable export with that same malformed name. generate.py itself requires the API key via a CLI flag (--api-key). The inconsistency in how the key is provided (env var name vs openclaw.json vs CLI) should be clarified to avoid accidentally storing the key in an unexpected location. No other unrelated secrets are requested.
Persistence & Privilege
The skill does not request always:true and does not attempt to modify other skills or system settings. It only writes generated images to a local output directory specified by the user (default ./generated). Autonomous invocation is allowed (platform default) but not elevated here.
What to consider before installing
This skill appears to do what it says (submit image-generation jobs and download results) but there are a few inconsistencies you should verify before installing or providing an API key: 1) Confirm the correct API host — SKILL.md and generate.py default to https://grsai.dakka.com.cn while the homepage is https://grsai.ai; verify whether grsai.dakka.com.cn is an official backend for grsai. 2) The declared primary environment variable name contains a space ("G RSAI_API_KEY"); that is almost certainly a typo — ask the author whether the intended name is something like GRSAI_API_KEY or G_RSAI_API_KEY. 3) decide how you will supply the API key (openclaw.json, environment variable, or CLI flag) and avoid storing keys in less secure locations. 4) Review the generate.py script yourself (it is included) and, if you will run it locally, run it in a controlled environment; the script only makes network requests to submit/poll/download images, but you should confirm the endpoints and TLS certs for authenticity. If you cannot confirm the host/variable issues, treat the skill as untrusted and do not provide production API keys.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🎨 Clawdis
Binsuv, curl
Primary envG RSAI_API_KEY
latestvk97dxcqbxwt4ebav1fzctxvkxx828y47
349downloads
0stars
1versions
Updated 8h ago
v1.0.0
MIT-0

🎨 grsai nano-banana 生图技能

使用 grsai 平台的 nano-banana 系列模型生成高质量图片,支持文生图和图生图。


📋 使用前准备

1. 获取 grsai API Key

  1. 访问 https://grsai.ai/zh/dashboard
  2. 注册/登录账户
  3. 进入 API Key 管理 页面
  4. 创建新的 API Key
  5. 充值 - 确保账户有足够 credits(生图消耗积分)

2. 配置 API Key

方式一:openclaw.json 配置(推荐)

{
  "skills": {
    "entries": {
      "grsai-nano-banana": {
        "apiKey": "sk-your-api-key-here"
      }
    }
  }
}

方式二:环境变量

export G RSAI_API_KEY="sk-your-api-key-here"

🚀 使用方法

方式一:自然语言对话(推荐)

直接告诉助理你的生图需求,助理会引导你确认方案:

用户:帮我生成一张可爱柴犬的头像
助理:好的,使用 nano-banana 生图需要确认以下信息:
      【必填】模型、提示词
      【选填】尺寸、比例、参考图
      ...

方式二:命令行调用

文生图:

uv run ~/.openclaw/workspace/skills/grsai-nano-banana/generate.py \
  --prompt "手绘版可爱柴犬头像" \
  --model "nano-banana-pro" \
  --resolution "1K" \
  --aspect-ratio "1:1" \
  --api-key "sk-xxx"

图生图:

uv run ~/.openclaw/workspace/skills/grsai-nano-banana/generate.py \
  --prompt "把这张图变成油画风格" \
  --input-image "https://example.com/photo.png" \
  --model "nano-banana-pro" \
  --api-key "sk-xxx"

📐 参数说明

必填参数

参数说明示例
--prompt提示词,清晰描述想要的内容"一只可爱的猫咪在草地上"
--api-keygrsai API Key"sk-xxx"

选填参数

参数默认值选项说明
--modelnano-banana-pronano-banana-pro<br>nano-banana-fast<br>nano-banana-2<br>nano-banana-pro-vip不同模型支持不同分辨率
--resolution1K1K / 2K / 4K分辨率越高,生成时间越长
--aspect-ratioautoauto / 1:1 / 16:9 / 9:16<br>4:3 / 3:4 / 3:2 / 2:3<br>5:4 / 4:5 / 21:9输出图片比例
--input-image-图片 URL参考图(图生图时使用)
--filename自动生成自定义文件名输出文件名
--output-dir./generated目录路径输出目录(默认相对于当前目录)

⏱️ 生成时间

模型1K2K4K
nano-banana-fast~2 分钟~3 分钟-
nano-banana-pro~5-8 分钟~8-12 分钟~15 分钟

注意:

  • 实际时间取决于 grsai 服务器负载
  • 高峰时段可能需要更长时间
  • 脚本会自动轮询,无需手动等待

📁 输出文件

保存路径: ./generated/(可自定义)

命名规则: yyyymmdd_模型_描述.png

示例:

  • 20260304_pro_手绘版可爱柴犬头像.png
  • 20260304_fast_sunset_beach.png

自定义输出目录:

uv run generate.py --prompt "xxx" --output-dir "/your/custom/path" --api-key "sk-xxx"

⚠️ 常见问题与踩坑记录

1. API 返回 "apikey credits not enough"

原因: 账户余额不足

解决:

  1. 登录 grsai 后台
  2. 检查当前 API Key 对应的账户
  3. 充值 credits

2. 生成超时 "gemini timeout... Please try again later"

原因: grsai 后端生成时间较长

解决:

  • 使用异步轮询模式(脚本默认)
  • 等待 5 分钟后开始轮询
  • 最多轮询 3 次,间隔 1 分钟
  • 如仍失败,稍后重试

3. 内容违规

原因: 提示词包含敏感内容

解决:

  • 调整提示词,避免敏感词汇
  • 使用更委婉的描述方式

4. 模型不支持的分辨率

原因: 某些模型有分辨率限制

限制说明:

  • nano-banana-pro-vip:仅支持 1K、2K
  • nano-banana-pro-4k-vip:仅支持 4K

解决: 选择正确的模型或调整分辨率


5. 接口返回空响应

原因: 请求格式不正确

正确格式:

{
  "model": "nano-banana-pro",
  "prompt": "xxx",
  "imageSize": "1K",
  "aspectRatio": "auto",
  "webHook": "-1",
  "shutProgress": false
}

注意: webHook: "-1" 是关键,让接口立即返回 task_id


6. 查询结果时参数错误

错误: 使用 task_id 参数

正确: 使用 id 参数

{"id": "1-xxxxx"}

🔧 技术细节

API 端点

接口URL方法
提交任务/v1/draw/nano-bananaPOST
查询结果/v1/draw/resultPOST

请求格式

提交任务:

curl -X POST "https://grsai.dakka.com.cn/v1/draw/nano-banana" \
  -H "Authorization: Bearer sk-xxx" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "nano-banana-pro",
    "prompt": "手绘版可爱柴犬头像",
    "imageSize": "1K",
    "aspectRatio": "1:1",
    "webHook": "-1",
    "shutProgress": false
  }'

查询结果:

curl -X POST "https://grsai.dakka.com.cn/v1/draw/result" \
  -H "Authorization: Bearer sk-xxx" \
  -H "Content-Type: application/json" \
  -d '{"id": "1-b834c0d4-dda7-4ab2-9ce6-378ea325ab3a"}'

响应格式

提交成功:

{
  "code": 0,
  "data": {
    "id": "1-b834c0d4-dda7-4ab2-9ce6-378ea325ab3a"
  },
  "msg": "success"
}

查询成功:

{
  "code": 0,
  "data": {
    "id": "1-xxxxx",
    "status": "succeeded",
    "progress": 100,
    "results": [{
      "url": "https://file3.aitohumanize.com/file/xxx.png"
    }]
  },
  "msg": "success"
}

📝 更新日志

  • 2026-03-04 - 初始版本
    • 支持文生图、图生图
    • 异步轮询模式
    • 自动保存至 ./generated/ 目录
    • 智能文件命名

🔗 相关链接

Comments

Loading comments...