Ace Banana2 Image Generation / Ace Banana2 图像生成
Security checks across malware telemetry and agentic risk
Overview
The skill appears to do what it claims, but it uses a third-party image API, stores your AceData token locally, and uploads any images you choose to edit.
Install this skill only if you trust the AceData service and the included script. Use a virtual environment for dependencies, keep the saved .env token private, monitor API quota usage, and avoid uploading sensitive images or prompts unless you are comfortable sending them to AceData.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A compromised or unexpected package version could affect the local environment where the script runs.
The skill asks the user to install Python dependencies manually without version pins. These packages are expected for the stated image API workflow, but users should install them from trusted package sources.
pip install requests pillow
Install dependencies in a virtual environment and consider pinning known-good versions of requests and pillow.
Anyone who can read the skill directory may be able to use the stored AceData API token and consume the user's quota.
The script prompts for an AceData bearer token and saves it to a .env file. This is expected for accessing the AceData API, but it creates a persistent local credential.
token = input("Please enter your AceData Bearer Token: ").strip() ... f.write(f"ACEDATA_API_KEY={token}\n")Protect the .env file, avoid sharing the skill directory after configuration, and rotate the API key if it may have been exposed.
Private prompts or images provided for editing may be processed by the external AceData service.
For edit mode, the script places local image data or URLs into the request payload and sends them to the AceData API. This is central to the skill's purpose, but it means selected image content leaves the local machine.
payload["image_urls"] = processed_urls ... resp = requests.post(API_URL, json=payload, headers=headers, timeout=180)
Only use images and prompts you are comfortable sending to AceData, and review the provider's privacy and retention terms before using sensitive content.