Alicloud Ai Image Qwen Image Edit

PassAudited by ClawScan on May 1, 2026.

Overview

This skill appears purpose-aligned for Alibaba Cloud image editing, with expected but important use of an SDK, API key, and local request/result files.

Before installing, make sure you are comfortable using an Alibaba Cloud DashScope API key, installing the DashScope SDK in a virtual environment, and keeping local request/result files that may contain image URLs or prompt details.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

A configured API key may allow use of the user’s Alibaba Cloud Model Studio account and could incur usage charges.

Why it was flagged

The skill discloses that it needs Alibaba Cloud/DashScope credentials for the intended provider integration, while the registry metadata lists no required credentials.

Skill content

Set `DASHSCOPE_API_KEY` in your environment, or add `dashscope_api_key` to `~/.alibabacloud/credentials`.

Recommendation

Use a scoped DashScope key where possible, keep it out of shared files, and monitor usage or billing after running image-edit tasks.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing an unpinned SDK can change behavior over time depending on the package version retrieved.

Why it was flagged

The setup instructions ask the user to install the external DashScope package in a virtual environment; this is purpose-aligned, but the package version is not pinned.

Skill content

python -m pip install dashscope

Recommendation

Install in the virtual environment as instructed and consider pinning a reviewed DashScope version for repeatable use.

Low

#ASI06: Memory and Context Poisoning

What this means

Local output files may retain sensitive prompt text, image URLs, or generated-result links after the task is complete.

Why it was flagged

The skill intentionally persists prompts, image references or result URLs, and model parameters for evidence and reproducibility.

Skill content

Save edit request payloads, result URLs, and model parameters under `output/alicloud-ai-image-qwen-image-edit/`. Keep one sample request/response pair for reproducibility.

Recommendation

Review or delete saved output files when they contain private images, private URLs, or sensitive editing instructions.