ClawHub

Nano Banana Pro Image Generator

v1.0.2

Generate AI images using Nano Banana Pro via Media.io OpenAPI. State-of-the-art image quality with advanced reasoning, multi-image fusion, character consiste...

⭐ 0· 95·0 current·0 all-time
by@wondershare-boop
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
ℹ
Purpose & Capability
The skill name/description, SKILL.md, code, and API JSON consistently target Media.io's Nano Banana Pro endpoints (openapi.media.io). However the registry summary at the top of the package incorrectly listed 'Required env vars: none' while SKILL.md and the code require an API_KEY; this is a packaging/metadata mismatch but not evidence of malicious behavior.
✓
Instruction Scope
SKILL.md instructs the agent to call Media.io endpoints and to provide API_KEY. The included scripts only open the provided c_api_doc_detail.json, construct requests to openapi.media.io, and do not read other system files, credentials, or forward data to external hosts. The code explicitly restricts outbound requests to https://openapi.media.io.
✓
Install Mechanism
No install spec; the skill is instruction-plus-scripts only. SKILL.md suggests installing the well-known 'requests' Python package which is appropriate for the included Python client. No archive downloads or third-party installers are present.
ℹ
Credentials
The only secret required is API_KEY (sent as X-API-KEY), which is proportional to a cloud image-generation API. The manifest-level omission of required env vars (registry metadata showing none) is inconsistent with SKILL.md and the code, so verify the API_KEY requirement before installing. No other credentials or unrelated environment variables are requested or accessed.
✓
Persistence & Privilege
The skill does not request always:true and does not modify other skills or system-wide settings. It runs as a standard client library and uses the API key provided at runtime or via environment.
Assessment
This package appears to be a straightforward Media.io client that needs your Media.io API_KEY. Before installing, verify the API_KEY requirement (SKILL.md and code use it) and confirm you trust the owner/source (owner ID unknown). Do not share your API key publicly; expect API usage to consume credits/billing on your Media.io account. If you want extra caution, run the skill in an isolated environment, inspect the included files yourself (scripts/skill_router.py and c_api_doc_detail.json), and confirm endpoints are openapi.media.io. The only real inconsistency is the registry metadata saying no env vars are required—treat that as a packaging error rather than a security red flag, but verify the API key handling and billing behavior before use.

Like a lobster shell, security has layers — review code before you run it.

latestvk97ahqntqqshaz6wcnshxpz4v5838ntz

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments