Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Nano Banana Pro Image Gen(基于API易代理站)
v0.1.1图片生成技能,当用户需要生成图片、视觉信息图、创建图像、编辑/修改/调整已有图片时使用此技能。基于中国的API易代理站(https://apiyi.com/)的NanoBananaPro模型的图片生成服务,无需访问外网。支持10种宽高比的图片比例(`1:1`、`16:9`、`9:16`、`4:3`、`3:4`、`...
⭐ 1· 1.5k·7 current·9 all-time
by无处不在@wuchubuzai2018
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description (image generation & editing) matches the included code: both Node.js and Python scripts construct requests and send prompts and base64-encoded input images to an image-generation endpoint (api.apiyi.com). Functionality requested (prompt, input images, resolution, aspect ratio) is coherent with the stated purpose.
Instruction Scope
Runtime instructions and scripts read local image files (to base64-encode them) and transmit prompts and image data to https://api.apiyi.com/v1beta/..., plus they require an API key (via --api-key or APIYI_API_KEY). The instructions limit scope to image generation tasks (no arbitrary file reads beyond input images), but they do transmit user-provided text and image data to an external service — which is expected for this purpose but important to surface. The SKILL.md explicitly instructs preserving the user's raw prompt and to include inline base64 image data, which increases what is sent to the remote service.
Install Mechanism
There is no install spec (instruction-only style with scripts included). No remote downloads or archive extraction are performed by the skill itself. The included scripts are plain JS/Python with direct HTTPS/requests calls; nothing appears obfuscated or to fetch additional code at runtime.
Credentials
The skill requires an API key (APIYI_API_KEY or --api-key) to operate, but the registry metadata lists no required env vars or primary credential — an inconsistency. The single credential asked for is proportional to the skill's function (access to api.apiyi.com), but the omission in metadata is a red flag for provenance/packaging quality. No other unrelated secrets are requested.
Persistence & Privilege
The skill does not request permanent/always-on inclusion and does not modify other skills or global agent configuration. It writes generated images to the current/output directory (expected) and reads only the input images specified by the user.
What to consider before installing
What to consider before installing:
- The code and instructions are coherent for an image-generation client that sends prompts and optional input images (base64) to api.apiyi.com (NanoBananaPro/Gemini 3 Pro). That means any prompt text and any images you pass will be transmitted to that remote service.
- Metadata omission: the skill requires an API key (APIYI_API_KEY) but the registry metadata did not declare any required env vars — this is an inconsistency. Confirm the skill's declared requirements match its runtime needs before trusting it.
- Trust and privacy: verify you trust api.apiyi.com and the skill author before sending sensitive images or prompts. If you must use it, create and use a limited/sandbox API key and avoid sending private images or secrets.
- Review the scripts locally: both scripts are readable (no obfuscation). If you have concerns, run them in an isolated environment (container/VM) to observe network traffic and file writes.
- Endpoint verification: the scripts use https://api.apiyi.com/... and SKILL.md references apiyi.com; confirm these endpoints are legitimate and that you are comfortable with data leaving your machine to that provider.
- If you rely on the registry metadata for permission checks or automation, request that the publisher update the metadata to declare APIYI_API_KEY as a required env var and provide provenance/homepage info. This would remove the main incoherence identified here.Like a lobster shell, security has layers — review code before you run it.
latestvk973ytz4tnc70rf3nk0mhxks0x82nz0x
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
