Nanobanana Plus

Use nanobanana-plus over HTTP to generate images with per-call model switching and aspect ratio control. Best for OpenClaw / 小龙虾 users who have a running nan...

Security Scan

The skill is internally consistent with its stated purpose: a small Node.js CLI wrapper that calls a nanobanana-plus HTTP service, requires only node, and does not request unrelated credentials or persist secrets.

Purpose & Capability

Name/description match the included files: the package is a Node CLI that sends HTTP requests to a nanobanana-plus service. Required binary (node) and the brew install of node are proportional and expected.

Instruction Scope

Runtime instructions and the script stay within scope: they call health/models/generate endpoints on the configured base-url, accept an explicit --token (not read from env or disk), and write returned images to local files. Note: the script prints MEDIA: lines and file paths (intended for chat provider attachments), which could expose local file paths to integrated chat providers — this is documented in SKILL.md and appears intentional.

Install Mechanism

Install spec is a single brew formula for node (official, expected). No downloads from untrusted URLs or archives; risk here is low and proportional to needing Node.js.

Credentials

The skill declares no required environment variables or secrets. The script accepts an explicit --token parameter but does not persist it or read other environment variables or local config files — this is consistent with the stated design.

Persistence & Privilege

Skill does not request permanent presence, does not modify other skills or system configs, and does not persist credentials to disk. It only writes generated image files to user-specified/current directories, which is expected behavior.

Assessment

This skill is a small CLI wrapper that expects a running nanobanana-plus HTTP service and Node.js. Before installing: ensure you trust the base URL you provide (the script will POST prompts and tokens there), pass private tokens only via --token (the skill intentionally does not persist them), and be aware generated images are saved to disk and the script prints file paths (MEDIA:...) which chat platforms may auto-attach. Also verify you want Homebrew to install Node on your system and that the GitHub project homepage matches what you expect.

nanobanana-plus for OpenClaw

Use the bundled script to call a running nanobanana-plus HTTP service.

Initialize once with a guided prompt:

node {baseDir}/scripts/nanobanana-plus.mjs init

Or pass the values explicitly:

node {baseDir}/scripts/nanobanana-plus.mjs init \
  --base-url "http://localhost:3456" \
  --token "your-private-token"

Default service URL:

http://localhost:3456

init does not store credentials on disk. It only prints the exact commands to run next.

Health check:

node {baseDir}/scripts/nanobanana-plus.mjs check --base-url "http://localhost:3456"

List models:

node {baseDir}/scripts/nanobanana-plus.mjs models \
  --base-url "http://localhost:3456" \
  --token "your-private-token"

Generate one image:

node {baseDir}/scripts/nanobanana-plus.mjs generate \
  --base-url "http://localhost:3456" \
  --prompt "一只橘猫坐在雨天窗台上" \
  --filename "cat-window.png" \
  --aspect-ratio "16:9" \
  --token "your-private-token"

Generate multiple images:

node {baseDir}/scripts/nanobanana-plus.mjs generate \
  --base-url "http://localhost:3456" \
  --prompt "cinematic sci-fi alley at night" \
  --filename "alley.png" \
  --output-count 2 \
  --model "gemini-3-pro-image-preview" \
  --token "your-private-token"

Notes:

• generate works with local or remote nanobanana-plus services.
• This skill intentionally requires explicit --token for private services instead of reading environment variables or local config files.
• edit and restore are intentionally omitted from the ClawHub skill so it does not send local file paths or local file contents over HTTP.
• The script writes image files locally and prints MEDIA: lines so supported chat providers can auto-attach the outputs.
• The script no longer reads tokens from environment variables and no longer stores credentials on disk.
• Use init, --token, or --base-url to control credentials and endpoint.
• If the service is not running, start it separately with nanobanana-plus api --port 3456.