技能 nano-image-generator

📦

nano-image-generator

Name: nano-image-generator
Author: lxfater

內容修訂 r1 高風險 🌐 網路存取📁 檔案系統存取🔑 環境變數⚙️ 外部命令

建立 Gemini 圖像素材

團隊需要在不離開程式開發工作流程的情況下快速取得視覺素材。此技能使用本機 Python 指令碼透過 Gemini 生成圖像，並將其儲存到專案資料夾中。

支援: Claude Codex Code(CC)

⚠️ 38 差

Maintain this Skill? Claim it ⚠️ 38 差

安裝前請停止並請求確認。

請審查安裝計畫，並在變更檔案前取得使用者明確同意。

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求

Review the Skillstore skill "nano-image-generator" from https://skillstore.io/skills/lxfater-nano-image-generator.md and its manifest at https://skillstore.io/api/skills/lxfater-nano-image-generator/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/lxfater-nano-image-generator.md 已簽名 manifest GET /api/skills/lxfater-nano-image-generator/manifest 已簽名 lockfile GET /api/skills/lxfater-nano-image-generator/lockfile

測試它

正在使用「nano-image-generator」。 Create a square app icon for a weather app with a simple cloud and sun symbol.

預期結果:

使用選定的輸出資料夾，儲存一個適合 app 圖示草稿的方形圖像檔案。

正在使用「nano-image-generator」。 Create a wide launch banner for a developer tool in a clean editorial style.

預期結果:

指令碼完成後傳回生成檔案路徑的橫向橫幅圖像。

正在使用「nano-image-generator」。 Use this character reference and place the same character in a warm cafe scene.

預期結果:

一張嘗試在不同場景中保留參考角色外觀的新圖像。

安全審計

高風險

v7 • 2026/7/5 開啟版本化報告

The skill provides a legitimate Gemini-backed image generation workflow, but it has meaningful security concerns. The main confirmed issues are hardcoded API key setup, external transfer of prompts and reference images, local Python command execution, and unrestricted output-path writes. Documentation-only URLs, Markdown formatting, magic-byte checks, and response image base64 decoding were adjudicated as false positives.

已掃描檔案

685

分析行數

複核項目

已忽略的誤報

已確認的安全問題 (3)

高

README.md:27-47 README_CN.md:27-47 scripts/generate_image.py:37-45

Hardcoded API Key Setup Workflow

The README files and Python script instruct users to replace a source-code placeholder with a real Gemini API key. This creates a high chance of committing or sharing a live credential.

The documentation explicitly says to replace the placeholder with an actual API key, and the script returns that literal value. This is direct evidence of unsafe credential storage by design.

中

scripts/generate_image.py:119-125 scripts/generate_image.py:143-147

Reference Images Sent to External API

The script reads each reference image, base64-encodes it, includes it in the request payload, and posts it to the Gemini API. Users may expose private images if they provide sensitive local files.

The code appends reference image bytes as inlineData and then sends the payload through urllib.request.urlopen. This is expected functionality, but it is a clear external data transfer.

中

scripts/generate_image.py:254-268

Unrestricted Output Path Write

The output path is provided by the caller, parent directories are created automatically, and image bytes are written to that path. A mistaken or manipulated path could overwrite files the process can access.

The script directly converts args.output into a Path, creates parent directories, and writes bytes. The forced image extension limits some abuse, but path scope is otherwise unrestricted.

能力複核項目 (30)

這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。

高

README_CN.md:29

Generic API/secret keys

编辑 `scripts/generate_image.py`,找到 `get_api_key()` 函数(约第 37 行):

The setup instructions direct users to edit the script function that returns the API key. This encourages storing a live credential in source code.

高

README_CN.md:32

Generic API/secret keys

def get_api_key():

The documented get_api_key function is the credential storage location. The surrounding setup text tells users to replace a placeholder with a real key.

高

README_CN.md:40

Generic API/secret keys

return "YOUR_GEMINI_API_KEY_HERE" # <-- Replace this with your API key

The snippet returns an API key placeholder from source code. Replacing it with a real key would hardcode a secret in the repository.

高

README_CN.md:43

Generic API/secret keys

将 `YOUR_GEMINI_API_KEY_HERE` 替换为你的实际 API key:

The documentation explicitly tells users to replace the placeholder with an actual API key. This is insecure credential handling.

高

README.md:29

Generic API/secret keys

Edit `scripts/generate_image.py`, find the `get_api_key()` function (around line 37):

The setup instructions direct users to edit the script function that returns the API key. This encourages storing a live credential in source code.

高

README.md:32

Generic API/secret keys

def get_api_key():

The documented get_api_key function is the credential storage location. The surrounding setup text tells users to replace a placeholder with a real key.

高

README.md:40

Generic API/secret keys

return "YOUR_GEMINI_API_KEY_HERE" # <-- Replace this with your API key

The snippet returns an API key placeholder from source code. Replacing it with a real key would hardcode a secret in the repository.

高

README.md:43

Generic API/secret keys

Replace `YOUR_GEMINI_API_KEY_HERE` with your actual API key:

The documentation explicitly tells users to replace the placeholder with an actual API key. This is insecure credential handling.

高

scripts/generate_image.py:5

Generic API/secret keys

Requires: Set your GEMINI_API_KEY in the get_api_key() function below.

The file-level instructions require placing the Gemini API key into the function below. This promotes hardcoded credential storage.

高

scripts/generate_image.py:37

Generic API/secret keys

def get_api_key():

The get_api_key function is used as the credential source for requests. Its implementation returns a literal string from the source file.

高

scripts/generate_image.py:45

Generic API/secret keys

return "YOUR_GEMINI_API_KEY_HERE" # <-- Replace this with your API key

The function returns a placeholder meant to be replaced by a real API key. Hardcoding a real secret here risks accidental disclosure.

高

scripts/generate_image.py:101

Generic API/secret keys

api_key = get_api_key()

The script retrieves the API key from the hardcoded function before making the request. This ties runtime authentication to source-stored credentials.

高

scripts/generate_image.py:103

Generic API/secret keys

if api_key == "YOUR_GEMINI_API_KEY_HERE":

The placeholder comparison confirms the expected setup is replacing a source-code literal with a real key. That setup pattern is insecure.

高

scripts/generate_image.py:105

Generic API/secret keys

print("Edit the get_api_key() function and replace YOUR_GEMINI_API_KEY_HERE", file=sys.stderr)

The error message instructs users to replace the placeholder in source code. This reinforces unsafe credential handling.

高

scripts/generate_image.py:108

Generic API/secret keys

url = f"{API_BASE}/{MODEL_ID}:generateContent?key={api_key}"

The API key is placed in the request URL query string. Query-string credentials can leak through logs, traces, or error reports.

中

scripts/generate_image.py:144

Python HTTP libraries

req = urllib.request.Request(url, data=data, headers=headers, method="POST")

The script creates a POST request containing the prompt and any encoded reference images. This sends user-provided content to an external API.

中

scripts/generate_image.py:147

Python HTTP libraries

with urllib.request.urlopen(req, timeout=180) as response:

The urlopen call performs the external request to Gemini. Network transfer is core behavior and should be disclosed to users.

中

SKILL.md:12-18

Ruby/shell backtick execution

```bash

This fenced block instructs users or agents to run the local Python generator script. External command execution is expected but it can make network requests and write files.

中

SKILL.md:22-24

Ruby/shell backtick execution

```bash

This fenced usage block shows direct execution of scripts/generate_image.py. The command is intentional but still invokes local code with user-controlled arguments.

中

SKILL.md:44-47

Ruby/shell backtick execution

```bash

This fenced example runs the Python script with a reference image and output path. It invokes local code that may read files and send data to the API.

中

SKILL.md:51-54

Ruby/shell backtick execution

```bash

This fenced example runs the Python generator with a reference image. The command is intentional but confirms external command use.

中

SKILL.md:58-61

Ruby/shell backtick execution

```bash

This fenced example runs the Python generator with multiple reference images. That can read local images and send them to the API.

中

SKILL.md:69-76

Ruby/shell backtick execution

```bash

This fenced workflow block contains several invocations of the Python generator. It confirms intended local command execution for batch image generation.

中

SKILL.md:102-105

Ruby/shell backtick execution

```bash

This fenced example runs the Python generator to create an app icon. It is legitimate usage but confirms command execution by the skill workflow.

中

SKILL.md:108-111

Ruby/shell backtick execution

```bash

This fenced example runs the Python generator to create a banner. It invokes local script execution with an output path.

中

SKILL.md:114-117

Ruby/shell backtick execution

```bash

This fenced example runs the Python generator for a knowledge card. It is an intended external command invocation.

中

SKILL.md:120-123

Ruby/shell backtick execution

```bash

This fenced example runs the Python generator with a reference image for style transfer. It can read the referenced file and send it externally.

中

SKILL.md:126-129

Ruby/shell backtick execution

```bash

This fenced example runs the Python generator with a character reference image. It confirms intended command execution and external processing of local files.

低

scripts/generate_image.py:23

Python HTTP libraries

import urllib.request

The imported urllib.request module is used later to call the Gemini API. This is expected for the feature but confirms external network capability.

低

scripts/generate_image.py:34

Hardcoded URL

API_BASE = "https://generativelanguage.googleapis.com/v1beta/models"

The hardcoded endpoint targets the Google Generative Language API. It is legitimate for the skill, but it is still a fixed third-party destination.

風險因素

🌐 網路存取 (9)

README_CN.md:38 README_CN.md:54 README.md:38 README.md:54 scripts/generate_image.py:23 scripts/generate_image.py:144 scripts/generate_image.py:147 scripts/generate_image.py:34 scripts/generate_image.py:43

📁 檔案系統存取 (4)

README_CN.md:57 README_CN.md:57 README.md:57 README.md:57

🔑 環境變數 (15)

README_CN.md:29 README_CN.md:32 README_CN.md:40 README_CN.md:43 README.md:29 README.md:32 README.md:40 README.md:43 scripts/generate_image.py:5 scripts/generate_image.py:37 scripts/generate_image.py:45 scripts/generate_image.py:101 scripts/generate_image.py:103 scripts/generate_image.py:105 scripts/generate_image.py:108

⚙️ 外部命令 (39)

審計單位: codex 檢視審計紀錄 →

分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告

複製報告連結

https://skillstore.io/skills/lxfater-nano-image-generator/audits/7?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/lxfater-nano-image-generator/security.svg)](https://skillstore.io/skills/lxfater-nano-image-generator?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/lxfater-nano-image-generator?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/lxfater-nano-image-generator/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/lxfater-nano-image-generator.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

學術引用 (APA · BibTeX · CFF)

APA 引用

lxfater. (2026). nano-image-generator security audit report (audit version 7) [Author version unspecified]. Skillstore. https://skillstore.io/skills/lxfater-nano-image-generator/audits/7

BibTeX 引用

@techreport{lxfater-lxfater-nano-image-generator-2026,
  author = {lxfater},
  title = {nano-image-generator security audit report (audit version 7)},
  institution = {Skillstore},
  year = {2026},
  number = {7},
  url = {https://skillstore.io/skills/lxfater-nano-image-generator/audits/7},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "nano-image-generator security audit report (audit version 7)"
version: "unspecified"
type: report
authors:
  - name: "lxfater"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/lxfater-nano-image-generator/audits/7"
identifiers:
  - type: other
    value: "skillstore:lxfater-nano-image-generator:audit:7"
    description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據證據置信度: 中

架構

可維護性

內容

社群

規範符合度

你可以打造什麼

生成產品圖像

直接從專案提示建立 app 圖示、UI 素材和功能插圖。

製作活動圖像

使用選定的長寬比和尺寸建立橫幅、社群圖像和發表視覺素材。

維持視覺一致性

使用參考圖像，在一系列素材中保持一致的風格或角色。

試試這些提示

基本圖像

Generate an image of a friendly robot mascot waving, with a clean modern style, and save it to the generated folder.

指定尺寸橫幅

Create a 16:9 website hero banner for a productivity app with abstract geometric shapes and a calm professional color palette.

參考風格

Use the reference image as the visual style and generate a new mountain scene with matching colors, lighting, and texture.

一致系列

Generate a three-image knowledge card series with a consistent layout, matching typography space, and a clear visual theme.

最佳實務

使用包含主體、風格、顏色、構圖和預期用途的具體提示。
將生成的素材儲存在符合其用途的專案資料夾中。
在將參考圖像傳送至外部 API 前先進行檢查。

避免

請勿在提交至原始碼控制的檔案中硬編碼真實 API 金鑰。
除非可接受外部處理，否則請勿傳送私人參考圖像。
請勿依賴生成圖像來取得精確文字、商標或最終品牌核准。

常見問題

這個技能使用哪個模型？

它是為 Gemini 3 Pro Preview 圖像生成而設計，該技能將其描述為 Nano Banana Pro。

它支援參考圖像嗎？

是。此指令碼接受最多 14 張參考圖像，用於風格轉換或角色一致性。

生成的圖像會儲存在哪裡？

使用者提供輸出路徑，指令碼會將傳回的圖像以偵測到的副檔名儲存在該處。

它需要網路存取權嗎？

是。它會向 Google Generative Language API 傳送請求以生成圖像。

API 金鑰如何設定？

目前的指令碼要求使用者將 Gemini API 金鑰放入原始檔案中。

它可以在圖像中建立精確文字嗎？

該技能指出文字算繪可能不完美，因此最終素材更適合使用文字疊加。

開發者詳細資訊

作者

lxfater

授權

MIT

Skillstore 修訂

版本提示

作者未聲明版本。

儲存庫

https://github.com/lxfater/nano-image-generator-skill/tree/main/

引用

62e2a730c5cd74eab4c7164309d810de660fcea3

維護新鮮度

2026/7/23

使用量

62 次下載 · 273 次瀏覽

檔案結構

📁 scripts/

📄 generate_image.py

📄 README_CN.md

📄 README.md

📄 SKILL.md