ClawHub

Nano Banana 2 Image Generator

v1.0.0

Generate AI images using Nano Banana Pro via Media.io OpenAPI. State-of-the-art image quality with advanced reasoning, multi-image fusion, character consiste...

⭐ 0· 91·0 current·0 all-time
by@wondershare-boop
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
ℹ
Purpose & Capability
Skill name, description, SKILL.md, c_api_doc_detail.json and the code all align: this is an adapter for Media.io's Nano Banana Pro image APIs. The only inconsistency is registry metadata that reported no required env vars while SKILL.md and the code require an API_KEY; this looks like an authoring/packaging oversight rather than malicious mismatch.
✓
Instruction Scope
SKILL.md instructions are narrowly scoped to obtaining an API_KEY, installing requests, and calling the Media.io endpoints. The included examples only reference the provided c_api_doc_detail.json and the script; there are no instructions to read unrelated system files or send data to unexpected endpoints.
✓
Install Mechanism
No install spec is present (instruction-only plus a small local Python script). There are no downloads or archive extraction steps. The only external dependency is the standard 'requests' Python package (documented in SKILL.md).
ℹ
Credentials
The skill requires a single API credential (API_KEY) for Media.io, which is proportionate to its stated function. However, the registry metadata omitted declaring this required env var while SKILL.md and the script enforce it — this inconsistency should be corrected before trusting automated tooling that relies on registry metadata.
✓
Persistence & Privilege
The skill does not request always:true or other elevated persistence. The script runs network calls only when invoked and restricts outbound hosts to openapi.media.io. The module has a __main__ example that queries credits when run as a script, but it does not autonomously persist or modify other skills or system settings.
Assessment
This skill appears to be a legitimate Media.io API wrapper and only needs your Media.io API_KEY. Before installing, verify you obtained the API key from developer.media.io and that you are comfortable giving the skill that key. Note the registry entry incorrectly omitted the required API_KEY — treat that as a packaging bug. Inspect or run the included scripts in a controlled environment (or review network logs) to confirm outbound requests go only to openapi.media.io. If you deploy this in production, prefer a scoped API key and monitor usage/credits on your Media.io account.

Like a lobster shell, security has layers — review code before you run it.

latestvk97ajcj0tqbyqyrade3rk9rv5d8352b7

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments