nano-banana-antigravity

SUSPICIOUS. The core image-generation purpose is plausible, but the skill’s trust model relies on direct reuse of local OpenClaw/Google OAuth credentials through a legacy/unofficial 'google-antigravity' path, with unclear endpoint transparency. No strong malware indicators or hidden execution are present, but credential handling and ambiguous data routing make the skill higher risk than a normal image API integration.

This code is a networked image-generation client that refreshes OAuth access tokens using refresh tokens found in local OpenClaw auth profile files, then calls internal CloudCode endpoints to generate and download images, writing the result to a file. It contains a high-severity anomaly: a hardcoded Google OAuth client secret. While there is no explicit malware (no exec/backdoor/exfil to unknown domains beyond the hardcoded endpoints), the combination of local credential access + hardcoded client secret + authenticated request automation makes it a noteworthy supply-chain/safety risk that should be reviewed carefully.