Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Ai Image Gen Skill

v1.0.0

AI图片生成技能,使用Gemini生成高质量图片,支持文生图和图生图

0· 3·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The skill claims 'AI图片生成' with Gemini, which fits needing a GEMINI_API_KEY, but the SKILL.md points to /usr/lib/node_modules/openclaw/skills/nano-banana-pro/scripts/generate_image.py — a script that is not part of this skill package and is from a differently named skill (nano-banana-pro). The external dependency is not declared in metadata.
!
Instruction Scope
Instructions tell the agent to run an absolute path to a local Python script (via 'uv run') and to read reference image files; they also state a required GEMINI_API_KEY. The metadata declares no env vars and no code files. The instructions therefore ask the agent to execute and access resources outside the skill's own bundle and to use an undeclared secret.
!
Install Mechanism
There is no install spec (instruction-only), which is normally low risk — but here the instructions rely on a specific script path under /usr/lib/node_modules/... that this skill did not install. That could cause execution of arbitrary local code if the referenced script exists and is malicious or unexpected.
!
Credentials
SKILL.md says '需要 GEMINI_API_KEY' but the skill metadata lists no required env vars or primary credential. Requesting an API key for Gemini is reasonable for an image generation skill, but the omission from declared requirements is an incoherence that prevents informed permissioning and review.
Persistence & Privilege
The skill is not always-enabled and uses normal autonomous invocation defaults. It does not request persistent system-wide privileges in the metadata.
What to consider before installing
Do not install or run this skill as-is. Key issues: SKILL.md instructs running an external script at /usr/lib/node_modules/openclaw/skills/nano-banana-pro/scripts/generate_image.py that is not included, and it requires GEMINI_API_KEY even though metadata lists no env vars. Before proceeding, ask the author for: (1) the actual code or an install spec that creates the referenced script path, (2) an explanation why the skill points to 'nano-banana-pro' instead of its own files, and (3) updated metadata declaring GEMINI_API_KEY. If you must test, inspect the referenced generate_image.py file contents and the 'uv' runner first, run in a sandboxed environment, and ensure the Gemini API key you provide follows least-privilege practices (rotate it, limit scope). Prefer skills with a verifiable source/homepage and included install steps or code.

Like a lobster shell, security has layers — review code before you run it.

latestvk973f1ztz8r1seztj5p3wtvrkx843tfa

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

AI图片生成技能

使用 AI 生成高质量图片。

核心命令

uv run /usr/lib/node_modules/openclaw/skills/nano-banana-pro/scripts/generate_image.py \
  --prompt "你的描述" --filename "output.jpg" --resolution 2K

参数说明

参数说明
--prompt图片描述(中英文都行)
--filename输出文件名
--resolution分辨率:1K / 2K
-i reference.jpg可选:参考图片(风格迁移、图片编辑)

使用示例

文生图

# 生成产品封面
uv run /usr/lib/node_modules/openclaw/skills/nano-banana-pro/scripts/generate_image.py \
  --prompt "极简白色背景产品展示图,现代科技感" \
  --filename cover.jpg \
  --resolution 2K

图生图(风格迁移)

# 基于参考图修改
uv run /usr/lib/node_modules/openclaw/skills/nano-banana-pro/scripts/generate_image.py \
  --prompt "把背景改成蓝天白云" \
  -i original.jpg \
  --filename edited.jpg

常用场景

# 公众号封面
--prompt "公众号封面:AI技术,科技感,简洁大气"

# 产品图
--prompt "产品展示图,白色背景,专业摄影风格"

# 插图
--prompt "文章配图:数据分析,图表,商务风格"

注意事项

  • 需要 GEMINI_API_KEY 环境变量
  • 支持 1K 和 2K 分辨率
  • 中英文 prompt 都支持

技能创建时间: 2026-03-17

Files

1 total
Select a file
Select a file to preview.

Comments

Loading comments…