Ace Banana2 Image Generation / Ace Banana2 图像生成
v1.0.3Generate and edit images using the AceData Nano Banana API. Supports models like nano-banana-2, custom aspect ratios (default 16:9), and resolutions (default...
⭐ 1· 275·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's purpose is image generation via AceData Nano Banana and the included script implements that. However, the registry metadata declares no required environment variables while both SKILL.md and the script require an AceData Bearer token (ACEDATA_API_KEY). This metadata omission is an incoherence the maintainer should explain.
Instruction Scope
Runtime instructions and the Python script only perform operations relevant to image generation/editing: accept prompts, encode local images to Base64, POST to the Nano Banana API, and save returned images. They do, however, prompt for and persist an API key to a .env file in the skill directory, and save generated images to the user's Desktop. The script prints full API JSON responses (which may contain metadata) and will read/write local image files — behavior consistent with the stated purpose but with privacy implications.
Install Mechanism
This is instruction-only with a local Python script; there is no remote binary download or packaged installer. Dependencies are pip-installable libraries (requests, pillow), which is proportionate for the task.
Credentials
The script requires and persists ACEDATA_API_KEY but the registry metadata lists no required env vars or primary credential. It also relies on USERPROFILE to locate the Desktop (Windows-specific) without documenting cross-platform behavior. Storing the Bearer token in plaintext in a .env file inside the skill directory is convenient but increases the chance of accidental token exposure.
Persistence & Privilege
The skill does persistently store the API key in a local .env file and creates folders/files on the user's Desktop. It does not request 'always: true', does not modify other skills, nor does it access unrelated system credentials. Persisting the token and writing to Desktop are expected for this type of script but are persistent actions you should be aware of.
What to consider before installing
This skill's code implements image generation against https://api.acedata.cloud and mostly matches its description, but there are a few red flags to consider before installing:
- The registry metadata does not declare that an AceData API key is required, yet the script prompts for and saves ACEDATA_API_KEY. Confirm you trust AceData and the skill author before providing a Bearer token.
- The script saves your API key in plaintext to a .env file inside the skill directory. If you install, consider moving that file to a secure location, deleting it after use, or manually setting ACEDATA_API_KEY in a secure environment rather than letting the script write it.
- SKILL.md and the script contain different registration/share URLs — verify the correct official registration page with the service to avoid phishing/typo-squatting links.
- The script uses USERPROFILE to save images to Desktop (Windows-only). On other OSes it may fail or behave unexpectedly; check and modify the save path if needed.
- The skill prints full JSON responses (may include API error details or task metadata); if you are concerned about exposing results, review or sanitize output before sharing.
If you decide to proceed: inspect the .env file after first run, consider running the script in an isolated environment (VM or container), and avoid reusing high-privilege tokens. If you need higher assurance, ask the skill author to update the registry metadata to declare the required ACEDATA_API_KEY and to document where tokens are stored and how to change the Desktop path.Like a lobster shell, security has layers — review code before you run it.
latestvk9709qxzajxqbztg0dd69f3ckd82pq3r
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
