Nano Banana Skill
PassAudited by ClawScan on May 1, 2026.
Overview
This is a coherent instruction-only image-generation API skill, but it uses a Monet API key and sends prompts or images to Monet’s external service.
This skill appears purpose-aligned and has no bundled executable code. Before installing, confirm you trust monet.vision, protect the MONET_API_KEY, and avoid sending sensitive prompts or images unless you accept the provider's handling and retention terms.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Using the skill may consume the user's Monet account quota or billing credits when image-generation tasks are created.
The skill requires a Monet API key to authenticate requests. This is expected for the stated API integration, but it gives the agent access to the user's Monet account for task creation.
requires:\n env:\n - MONET_API_KEY # Required: API key from monet.vision
Use a dedicated or least-privileged API key if available, keep it out of source code, and revoke or rotate it if the skill is no longer needed.
The agent can create generation jobs when invoked, which may use paid service capacity or create account history on monet.vision.
The documented workflow creates external asynchronous image-generation tasks. This is central to the skill, but it is an action on a third-party service rather than a purely local operation.
curl -X POST https://monet.vision/api/v1/tasks/async ... "type": "image" ... "idempotency_key": "unique-key-123"
Install only if you want the agent to create Monet image-generation tasks, and review prompts and generation requests before submitting sensitive or costly jobs.
Reference images or other uploaded files may be stored temporarily by the provider and could contain private or identifying content.
The skill documents uploading user files to the external Monet service, with a stated 24-hour retention period. This is disclosed and relevant to image generation, but it moves user content outside the local environment.
POST `/api/v1/files` ... Upload a file to get an online access URL. ... Uploaded files are stored for **24 hours**
Avoid uploading confidential images or personal data unless you are comfortable with Monet's storage and terms; review the provider's privacy policy before use.