Banana Api
AdvisoryAudited by Static analysis on Apr 30, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Anyone with access to the saved config file may be able to use the Banana API key.
The skill uses and can persist a provider API key. This is purpose-aligned for an API client, but it is sensitive credential material.
python3 scripts/banana_gen.py --setup
# Or manually create config file
echo '{"api_key": "sk-your-key-here"}' > ~/.openclaw/workspace/config/banana-api.jsonOnly enter a key for an account you intend to use with this skill, protect the config file, and remove or rotate the key if you no longer use the skill.
Prompts and selected images leave the local machine and are processed by the external Banana API service.
When editing an image, the script base64-encodes local image content and sends it with the prompt to the external API endpoint.
API_BASE_URL = "https://nn.147ai.com" ... "data": image_b64 ... response = requests.post(url, headers=headers, json=data, timeout=120)
Use this only with images and prompts you are comfortable sending to that provider, and verify the service endpoint before using sensitive content.
If a channel ID is provided, generated media may be posted to Discord without a separate manual review step.
The optional Discord path uses the OpenClaw messaging CLI to send the generated image to a specified Discord channel.
'openclaw', 'message', 'send', '--channel', 'discord', '--target', channel_id, '--caption', caption, '--media', str(image_path)
Use Discord auto-send only for intended channels and consider reviewing generated images locally before posting.