Banana Api

PassAudited by ClawScan on May 1, 2026.

Overview

This image-generation helper appears coherent, but it sends prompts/images to an external API, can store an API key, and can post results to Discord when requested.

Before installing, confirm you trust the Banana API endpoint, use a scoped API key if possible, avoid sending private images unless appropriate, and only enable Discord auto-send for channels where you intend to publish the result.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

Anyone with access to the saved config file may be able to use the Banana API key.

Why it was flagged

The skill uses and can persist a provider API key. This is purpose-aligned for an API client, but it is sensitive credential material.

Skill content

python3 scripts/banana_gen.py --setup

# Or manually create config file
echo '{"api_key": "sk-your-key-here"}' > ~/.openclaw/workspace/config/banana-api.json

Recommendation

Only enter a key for an account you intend to use with this skill, protect the config file, and remove or rotate the key if you no longer use the skill.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Prompts and selected images leave the local machine and are processed by the external Banana API service.

Why it was flagged

When editing an image, the script base64-encodes local image content and sends it with the prompt to the external API endpoint.

Skill content

API_BASE_URL = "https://nn.147ai.com"
...
"data": image_b64
...
response = requests.post(url, headers=headers, json=data, timeout=120)

Recommendation

Use this only with images and prompts you are comfortable sending to that provider, and verify the service endpoint before using sensitive content.

Note

ASI02: Tool Misuse and Exploitation

What this means

If a channel ID is provided, generated media may be posted to Discord without a separate manual review step.

Why it was flagged

The optional Discord path uses the OpenClaw messaging CLI to send the generated image to a specified Discord channel.

Skill content

'openclaw', 'message', 'send',
'--channel', 'discord',
'--target', channel_id,
'--caption', caption,
'--media', str(image_path)

Recommendation

Use Discord auto-send only for intended channels and consider reviewing generated images locally before posting.