Nano Banana Prompting Skill

PassAudited by ClawScan on May 1, 2026.

Overview

The skill appears purpose-aligned for Gemini image prompting, but users should notice that it uses a Gemini API key and delegates actual image generation to a local helper script.

This skill looks safe to install if you intend to generate images with Gemini. Before using it, make sure the referenced nano-banana-pro or Gemini generator script is trusted, set your Gemini API key carefully, and avoid sending sensitive reference images unless you are comfortable with the provider handling them.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Using the skill may consume Gemini API quota or incur provider-side usage, depending on the user's account.

Why it was flagged

The skill requires a Gemini API key, which is expected for Gemini image generation but still grants access to the user's provider account or quota.

Skill content
"requires": { "bins": ["uv"], "env": ["GEMINI_API_KEY"] }, "primaryEnv": "GEMINI_API_KEY"
Recommendation

Use a dedicated or least-privileged Gemini API key where possible, monitor usage, and avoid sharing the key in prompts or files.

What this means

The separate generator script will determine how prompts, reference images, output paths, and the Gemini API key are handled.

Why it was flagged

The artifact is instruction-only and delegates actual image generation to another local skill or script, so the safety of that helper matters.

Skill content
**Requires:** The `nano-banana-pro` skill (bundled with OpenClaw) or any Gemini image generation script.
Recommendation

Install or use only a trusted, reviewed Gemini image-generation helper such as the expected bundled skill.

What this means

When asked to generate an image, the agent may run a local helper command and create an output image file.

Why it was flagged

The skill instructs the agent to run a local Python image-generation helper. This is disclosed and central to the stated image-generation purpose.

Skill content
uv run {nano-banana-pro-dir}/scripts/generate_image.py --prompt '<YOUR_JSON_PROMPT>' --filename "<descriptive-name>.png" --resolution 2K
Recommendation

Confirm the helper script is trusted and keep output filenames/path choices simple and intentional.

What this means

Private prompts or reference images used for generation may be sent to or processed by the Gemini provider workflow.

Why it was flagged

For edits, the workflow passes a user-provided reference image path to the Gemini image-generation helper, implying the image may be processed by the external generation service.

Skill content
For image editing (user provides a reference image): ... -i "/path/to/reference.png"
Recommendation

Avoid using sensitive personal or confidential reference images unless you are comfortable with the Gemini provider's handling of them.