Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

ZenMux Image Gen (Nano Banana 2)

v1.0.0

Generate images from text prompts using ZenMux API (Vertex AI protocol with Gemini models). Use when: (1) User wants to generate/create images from text desc...

0· 341·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for thinkthinking/zenmux-image-gen.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "ZenMux Image Gen (Nano Banana 2)" (thinkthinking/zenmux-image-gen) from ClawHub.
Skill page: https://clawhub.ai/thinkthinking/zenmux-image-gen
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Canonical install target

openclaw skills install thinkthinking/zenmux-image-gen

ClawHub CLI

Package manager switcher

npx clawhub@latest install zenmux-image-gen
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name, description, SKILL.md, and the script all target ZenMux image generation (Vertex AI/Gemini models). That purpose aligns with the code's network calls to https://zenmux.ai/... and the CLI options. However, the registry metadata claims 'Required env vars: none' whereas SKILL.md and the script explicitly require ZENMUX_API_KEY — this mismatch suggests sloppy metadata or incomplete publishing.
Instruction Scope
Runtime instructions and the script stay within the stated purpose: building a request from a prompt (and optional input image), POSTing to the ZenMux Vertex-like endpoint, and saving returned image bytes. The SKILL.md warns not to pass API keys on the command line (good). The SKILL.md and script do not request unrelated system files, other credentials, or external endpoints beyond zenmux.ai.
Install Mechanism
This is an instruction-only skill with no install spec; the included script is executed directly. No download/install steps or third-party package pulls are present in the manifest, which reduces install-time risk.
!
Credentials
The code and SKILL.md require a ZENMUX_API_KEY (or --api-key) to call the API, which is proportionate to the task. But the registry metadata declares no required env vars — an inconsistent declaration. Additionally, the script provides a --api-key CLI flag even though the SKILL.md explicitly warns against using it (exposure risk via shell history). No other credentials are requested, which is appropriate.
Persistence & Privilege
The skill does not request persistent/always-on presence and does not modify other skills or system config. It runs as a normal user-invokable script and does not escalate privileges in the visible code.
What to consider before installing
This skill appears to implement a legitimate ZenMux image-generation client, but exercise caution: (1) the package metadata does not declare the ZENMUX_API_KEY even though both SKILL.md and the script require it — verify the publisher and why metadata is incomplete; (2) the provided script appears truncated in the bundle listing (file output was cut off), so request or review the full script before running — the missing tail could contain unexpected behavior; (3) follow the SKILL.md advice and do not pass API keys on the command line; set ZENMUX_API_KEY in a secure environment variable instead; (4) confirm network endpoints (the script calls only zenmux.ai) and, if you must run it, do so in an isolated environment/container and inspect the full source; (5) if you need higher assurance, ask the publisher for complete source and a signed release or prefer an official client from zenmux.ai.

Like a lobster shell, security has layers — review code before you run it.

latestvk978qfmth4etjwwsv52fapcyhd826bde
341downloads
0stars
1versions
Updated 50m ago
v1.0.0
MIT-0

ZenMux Image Generation

Generate images from text prompts using ZenMux API with Google Gemini models.

Quick Start

# Generate image (requires ZENMUX_API_KEY env var)
python3 scripts/generate_image.py "A cute cat" output.png

# With aspect ratio and resolution
python3 scripts/generate_image.py "A cute cat" output.png --aspect-ratio 16:9 --image-size 2K

API Key Setup

Get your API key from https://zenmux.ai.

# Set environment variable
export ZENMUX_API_KEY="sk-..."

Security Rules:

  • NEVER use --api-key flag (visible in shell history)
  • NEVER commit API keys to git

Script Options

OptionDescription
--model MODELModel name (default: google/gemini-3.1-flash-image-preview)
--input-image PATHInput image for image-to-image generation
--temperature NRandomness 0.0-2.0 (default: 1.0)
--max-tokens NMax output tokens
--aspect-ratio RATIO1:1, 2:3, 3:2, 3:4, 4:3, 9:16, 16:9, 21:9
--image-size SIZE1K (default), 2K, 4K

Image-to-Image

Edit existing images with text prompts:

python3 scripts/generate_image.py "Make it nighttime" result.png --input-image photo.jpg

Available Models

ModelAliasUse Case
google/gemini-3.1-flash-image-previewNano Banana 2Fast & quality (default)
google/gemini-3-pro-image-previewNano Banana ProBest quality
google/gemini-2.5-flash-imageNano BananaFaster generation

Prompt Tips

Writing effective prompts:

  • Be specific: "A golden retriever puppy playing on grass" instead of "a dog"
  • Include details: lighting (golden hour, soft light), style (photorealistic, anime, oil painting)
  • For image-to-image: describe the desired change clearly, e.g., "Change to nighttime with city lights"
  • Try 10+ words for better results

Troubleshooting

ErrorFix
Input image not foundCheck file path; verify file exists
Image too largeMax input size is 20 MB; compress before uploading
401 UnauthorizedCheck ZENMUX_API_KEY is set correctly
429 Rate limitedWait and retry, or upgrade to paid tier
Request timeoutAPI may be slow; wait and retry
Network errorCheck internet connection
No image in responseTry a different prompt or model
Poor image qualityUse more descriptive prompt (10+ words)

Script Features

  • Timeout protection: Requests timeout after 300 seconds (5 minutes)
  • Auto-create directories: Output directories are created automatically
  • Auto-rename on conflict: If output file exists, automatically appends number (e.g., image_1.png, image_2.png)
  • Input validation: Checks image format, size, and existence
  • Clear error messages: Human-readable error explanations
  • Format support: JPG, PNG, WebP, GIF input formats

Batch Generation

Generate multiple images by running the script multiple times with different outputs:

# Generate variations of the same prompt
for i in 1 2 3; do
  python3 scripts/generate_image.py "A cute cat in different poses" "cat_$i.png"
done

Comments

Loading comments...