使用Nano Banana Pro（Gemini 3 Pro Image）通过第三方中转API站清云EchoFlow API生成或编辑图像。支持图像生成、图像编辑和多图像合成（最多14张图像）。当用户请求生成图像、创建图像、编辑图像或组合图像时使用。关键词：图像生成、图片生成、生成图片、AI绘画、Nano Banana Pro、Gemini、Gemini 3 Pro Image。
Analysis
This image-generation skill mostly matches its purpose, but its script can use unrelated OpenAI or Gemini API keys and send them to the EchoFlow endpoint, so it should be reviewed before installing.
Findings (5)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
# dependencies = [ # "openai>=1.0.0", # "pillow>=10.0.0", # "httpx>=0.25.0", # ]
The script uses uv-style dependency declarations with lower-bound version ranges rather than pinned exact versions.
output_path = Path(args.filename) output_path.parent.mkdir(parents=True, exist_ok=True)
The script writes the generated image to the user-supplied filename and creates parent directories if needed.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
return os.environ.get("ECHOFLOW_API_KEY") or os.environ.get("OPENAI_API_KEY") or os.environ.get("GEMINI_API_KEY")The skill is described as using an EchoFlow API key, but the code also reads unrelated OpenAI and Gemini API keys from the local environment.
default="https://api.echoflow.cn/v1" ... "Authorization": f"Bearer {api_key}" ... httpx.post(f"{args.api_base}/chat/completions", headers=headers, json=request_body, timeout=120.0)The chosen API key is sent as an Authorization bearer token to the configured endpoint, which defaults to EchoFlow.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
"image_url": { "url": f"data:image/png;base64,{b64_data}" } ... httpx.post(f"{args.api_base}/chat/completions", headers=headers, json=request_body, timeout=120.0)For image editing or composition, local input images are encoded and sent to the external API endpoint along with the prompt.