Kie AI Nano Banana Pro 生图

PassAudited by ClawScan on May 10, 2026.

Overview

This is a coherent instruction-only Kie AI image-generation skill, but users should notice it requires a Kie API key and sends prompts or reference image URLs to an external API.

This skill appears purpose-aligned for Kie AI image generation. Before installing or using it, verify the publisher, configure the Kie API key securely, confirm any paid or batch generation requests, and only provide reference images or callback URLs you are comfortable sending to Kie AI.

Findings (5)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Using the skill may consume quota or paid credits on the user's Kie AI account.

Why it was flagged

The skill requires a Kie AI API key to submit image-generation jobs, while the registry metadata declares no primary credential.

Skill content
Authorization: Bearer YOUR_API_KEY
Recommendation

Store the API key only in a trusted credential configuration, use a limited-scope or revocable key if available, and review costs before batch or 4K generation.

What this means

Prompts, selected reference image URLs, and generation parameters may be sent to Kie AI, and task creation may incur usage costs.

Why it was flagged

The skill instructs the agent to create image-generation tasks through an external API endpoint, which is expected for the stated image-generation purpose.

Skill content
POST https://api.kie.ai/api/v1/jobs/createTask
Recommendation

Confirm the prompt, reference images, resolution, and batch size before submitting jobs, especially for paid or production use.

What this means

A callback endpoint may receive task IDs and generated image URLs; if the endpoint is not secured, another party could spoof or observe callback traffic.

Why it was flagged

The skill supports webhook callbacks for task completion, and the documentation advises signature verification.

Skill content
"callBackUrl": "https://your-domain.com/api/callback"
Recommendation

Use HTTPS callback URLs, verify webhook signatures, and avoid exposing sensitive generated images through public callback handlers.

What this means

The package may not include the implementation implied by its metadata, so users are relying on instructions rather than reviewed runnable code.

Why it was flagged

The manifest references a TypeScript entry point, but the provided artifact set contains no src/index.ts and is described as instruction-only.

Skill content
"main": "src/index.ts"
Recommendation

Treat this as an instruction-only skill unless the referenced source file is provided and reviewed; verify the repository if installing from an external source.

What this means

Users might assume official affiliation or support that is not proven by the supplied metadata.

Why it was flagged

The wording presents the skill as an official assistant, while the registry source is listed as unknown and the author is not shown as Kie AI.

Skill content
Kie AI Nano Banana Pro 官方生图助手
Recommendation

Verify the publisher and official Kie AI documentation before trusting the skill with account credentials or production workflows.