Nano Banana Pro

Generate or edit images via Gemini 3 Pro Image (Nano Banana Pro).

Security Scan

The skill's code and runtime instructions are consistent with its stated purpose (calling Gemini image APIs to generate/edit images) and request only the expected API key; minor metadata/installation inconsistencies deserve attention but do not indicate malicious behavior.

Purpose & Capability

The script and SKILL.md implement image generation/editing via the Google genai client and only require an API key, which matches the description. Minor inconsistency: the top-level registry metadata shows no required binaries or install spec, but the SKILL.md metadata declares 'uv' as a required binary and includes a brew install entry for it. This mismatch is likely an authoring oversight rather than malicious, but it should be noted.

Instruction Scope

Runtime instructions confine actions to: reading GEMINI_API_KEY (or receiving --api-key), loading user-supplied input image files, calling the Google GenAI client, and writing a single output PNG path (printing a MEDIA: token). The SKILL.md warns not to read the image back; the script does not exfiltrate image contents. No unrelated files, system paths, or extra env vars are accessed.

Install Mechanism

There is no registry-level install spec, but the SKILL.md metadata suggests installing 'uv' via Homebrew and the script lists Python dependencies (google-genai, pillow) in comments. These are reasonable for the task, but the skill does not include explicit pip install steps in the registry metadata — expect the user to have or install the required tools. No downloads from untrusted URLs or extract actions are present in the packaged files.

Credentials

Only GEMINI_API_KEY (or the --api-key argument) is used to authenticate to the Google GenAI API. That single credential is proportionate to the stated purpose. The SKILL.md optionally suggests storing the key in ~/.clawdbot/moltbot.json, which is a convenience but not required by the script.

Persistence & Privilege

The skill does not request always:true and is user-invocable; it does not modify other skill or system configurations. Suggesting placement of the API key in moltbot.json could persist the secret, but that is a user-controlled action rather than an automatic privilege the skill asserts.

Assessment

This skill appears to do what it says: call Google's Gemini (via google-genai) to generate or edit images and save a PNG. Before installing: 1) Only provide a GEMINI_API_KEY (or pass it per-run); avoid pasting unrelated secrets. If you store the key in ~/.clawdbot/moltbot.json be aware that the key will be persisted on disk — consider using environment variables or restricting the file's permissions. 2) The SKILL.md suggests installing 'uv' (Homebrew) and the Python libraries google-genai and pillow; review the provenance of those packages (use official sources). 3) The registry metadata and SKILL.md disagree about install requirements (uv present in SKILL.md metadata but not in top-level registry fields) — this is likely a packaging oversight but verify you have the required runtime tools. 4) If you're unsure about trust, run the script in an isolated environment (container/VM) and only provide an API key with minimal scope. Overall there are no signs of data-exfiltration or unrelated credential access in the included files.

Nano Banana Pro (Gemini 3 Pro Image)

Use the bundled script to generate or edit images.

Generate

uv run {baseDir}/scripts/generate_image.py --prompt "your image description" --filename "output.png" --resolution 1K

Edit (single image)

uv run {baseDir}/scripts/generate_image.py --prompt "edit instructions" --filename "output.png" -i "/path/in.png" --resolution 2K

Multi-image composition (up to 14 images)

uv run {baseDir}/scripts/generate_image.py --prompt "combine these into one scene" --filename "output.png" -i img1.png -i img2.png -i img3.png

API key

• GEMINI_API_KEY env var
• Or set skills."nano-banana-pro".apiKey / skills."nano-banana-pro".env.GEMINI_API_KEY in ~/.clawdbot/moltbot.json

Notes

• Resolutions: 1K (default), 2K, 4K.
• Use timestamps in filenames: yyyy-mm-dd-hh-mm-ss-name.png.
• The script prints a MEDIA: line for Moltbot to auto-attach on supported chat providers.
• Do not read the image back; report the saved path only.