Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Nm Conjure Qwen Delegation

v1.0.0

Qwen CLI delegation workflow implementing delegation-core for Alibaba's

0· 49·1 current·1 all-time
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description state this is a Qwen CLI delegation implementation and the SKILL.md only references qwen-cli, Python, and the shared delegation-core; the declared required config path (night-market.delegation-core) matches the stated purpose.
Instruction Scope
Runtime instructions instruct the user/agent to install and run the qwen CLI and a local delegation_executor script (~/conjure/tools/delegation_executor.py), and to include files via the qwen @path mechanism. These actions are expected for delegating to a remote LLM, but they will send included file contents to the Qwen service — a potential data-exfiltration surface that is coherent with the skill's purpose but worth explicit user awareness. The skill also references shared delegation-core docs that are not bundled here.
Install Mechanism
No install spec is bundled (instruction-only). The SKILL.md recommends 'pip install qwen-cli' which is a standard package install instruction; nothing in the metadata forcibly downloads or writes code to disk during install.
Credentials
The skill declares no required environment variables, but the docs show optional use of QWEN_API_KEY or 'qwen auth login'. That is proportional for a CLI delegation plugin. Users should note that any files included via @path will be transmitted to the Qwen service, and API keys or auth present in the environment would be used by the qwen CLI.
Persistence & Privilege
Flags are default (always: false, user-invocable true). The skill does not request permanent presence or system-wide privilege changes and contains no install-time scripts that would alter other skills or system configuration.
Assessment
This skill appears to do what it claims (delegate tasks to the Qwen CLI). Before installing or using it: (1) understand that any files you include (via @path or delegation_executor) will be sent to the remote Qwen service — avoid sending secrets or sensitive data; (2) verify you trust the qwen-cli package source if you run 'pip install qwen-cli'; (3) confirm the local path referenced (~/conjure/tools/delegation_executor.py) exists and review its code before executing; (4) check your Qwen API key, quotas, and usage logging since the skill references quota checks and centralized analytics; and (5) be aware the SKILL.md references shared delegation-core files that are not bundled here — review those shared components if you rely on this skill.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🦞 Clawdis
Confignight-market.delegation-core
latestvk97d2pavyashseskmj062ytjvh84ns2h
49downloads
0stars
1versions
Updated 1w ago
v1.0.0
MIT-0

Night Market Skill — ported from claude-night-market/conjure. For the full experience with agents, hooks, and commands, install the Claude Code plugin.

Table of Contents

Qwen CLI Delegation

Overview

This skill implements conjure:delegation-core for the Qwen CLI using shared delegation patterns. It provides Qwen-specific authentication, quota management, and command construction.

When To Use

  • After Skill(conjure:delegation-core) determines Qwen is suitable
  • When you need Qwen's large context window (100K+ tokens)
  • For batch processing, summarization, or multi-file analysis
  • If the qwen CLI is installed and configured

When NOT To Use

  • Deciding which model to use (use delegation-core first)
  • Qwen CLI not installed
  • Deciding which model to use (use delegation-core first)
  • Qwen CLI not installed

Prerequisites

Installation:

# Install Qwen CLI
pip install qwen-cli

# Verify installation
qwen --version

# Check authentication
qwen auth status

# Login if needed
qwen auth login

# Or set API key
export QWEN_API_KEY="your-key"

Verification: Run python --version to verify Python environment.

Delegation Flow

Implements standard delegation-core flow with Qwen specifics:

  1. qwen-delegation:auth-verified - Verify Qwen authentication
  2. qwen-delegation:quota-checked - Check Qwen API quota
  3. qwen-delegation:command-executed - Execute via Qwen CLI
  4. qwen-delegation:usage-logged - Log Qwen API usage

Quick Start

Using Shared Delegation Executor

# Basic file analysis
python ~/conjure/tools/delegation_executor.py qwen "Analyze this code" --files src/main.py

# With specific model
python ~/conjure/tools/delegation_executor.py qwen "Summarize" --files src/**/*.py --model qwen-max

# With output format
python ~/conjure/tools/delegation_executor.py qwen "Extract functions" --files src/main.py --format json

Verification: Run python --version to verify Python environment.

Direct CLI Usage

# Basic command
qwen -p "@path/to/file Analyze this code"

# Multiple files
qwen -p "@src/**/*.py Summarize these files"

# Specific model
qwen --model qwen-max -p "..."

Verification: Run the command with --help flag to verify availability.

Save Output

qwen -p "..." > delegations/qwen/$(date +%Y%m%d_%H%M%S).md

Verification: Run the command with --help flag to verify availability.

Smart Delegation

The shared delegation executor can auto-select the best service:

# Auto-select based on requirements
python ~/conjure/tools/delegation_executor.py auto "Analyze large codebase" \
  --files src/**/* --requirement large_context

Verification: Run python --version to verify Python environment.

Shared Patterns

This skill uses shared infrastructure from delegation-core:

  • Shell Execution: See delegation-core/shared-shell-execution.md
  • Authentication: Standard CLI authentication patterns
  • Quota Management: Unified quota tracking
  • Usage Logging: Centralized usage analytics

Qwen-Specific Details

For Qwen-specific models, CLI options, cost reference, and troubleshooting, see modules/qwen-specifics.md.

Exit Criteria

  • Authentication confirmed working
  • Quota checked and sufficient
  • Command executed successfully using shared infrastructure
  • Usage logged for tracking with unified analytics

Comments

Loading comments...