Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
OpenClaw Pro
v1.0.2Generate or edit images via Gemini 3 Pro Image (Nano Banana Pro).
⭐ 0· 75·0 current·1 all-time
by@jeayoo
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description, required binary (uv), and primary env var (GEMINI_API_KEY) align with the included script which calls google.genai. However the SKILL.md metadata lists dependencies (requests, beautifulsoup4) that the script never imports, while the script header and imports require google-genai and pillow. Also the ownerId in _meta.json differs from the registry ownerId in the provided metadata—these mismatches are packaging/authoring inconsistencies.
Instruction Scope
Runtime instructions are narrowly scoped: run the bundled script with prompt/filename and optional input images. The script only reads input images you explicitly pass, uses the GEMINI_API_KEY or --api-key, uploads content to Google's GenAI client, and writes the generated PNG to the requested output path. It prints a MEDIA:<path> token for attachment and does not attempt to read unrelated files or exfiltrate other environment variables.
Install Mechanism
Install spec only installs the 'uv' brew formula, which matches the expected runtime invocation. There is no automated installation declared for the Python packages the script needs (google-genai, pillow). That mismatch means the script may fail at runtime unless the environment already provides those Python deps; it's an operational inconsistency rather than an explicit security issue.
Credentials
Only GEMINI_API_KEY is required (declared as primaryEnv). The script uses only that key (or --api-key). No other credentials, secrets, or unrelated environment variables are requested.
Persistence & Privilege
The skill does not request always:true, does not modify other skills or global configs, and does not persist credentials itself. It only writes generated image files to the user-specified output path.
What to consider before installing
This skill mostly looks like a legitimate Gemini image helper, but there are a few packaging inconsistencies you should check before installing: 1) Confirm you trust the source—registry ownerId vs _meta.json ownerId differ. 2) Ensure you are comfortable providing GEMINI_API_KEY (this is the only credential requested). 3) The SKILL.md and script disagree about Python dependencies: the script needs google-genai and pillow, while SKILL.md lists requests and beautifulsoup4; your environment must have the actual Python packages installed or the script will fail. 4) The install step only installs the 'uv' brew formula; it will not install Python packages automatically. If those points are acceptable (or you can fix the dependencies locally), the skill is reasonable to use. If you need higher assurance, ask the author for a corrected package manifest and consistent metadata (matching ownerId and explicit Python install steps).Like a lobster shell, security has layers — review code before you run it.
latestvk975ktt0csnzn981h78v21v0x183ngcw
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🍌 Clawdis
Binsuv
EnvGEMINI_API_KEY
Primary envGEMINI_API_KEY
Install
Install uv (brew)
Bins: uv
brew install uv