Alicloud Ai Image Qwen Image Edit

PassAudited by VirusTotal on May 12, 2026.

Overview

Type: OpenClaw Skill Name: alicloud-ai-image-qwen-image-edit Version: 1.0.1 The skill bundle provides a legitimate interface for Alibaba Cloud's Qwen Image Edit models. It includes a helper script (scripts/prepare_edit_request.py) for JSON request formatting and response validation, and standard instructions in SKILL.md for environment setup using the official 'dashscope' SDK. No indicators of data exfiltration, malicious execution, or prompt injection were found.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

A configured API key may allow use of the user’s Alibaba Cloud Model Studio account and could incur usage charges.

Why it was flagged

The skill discloses that it needs Alibaba Cloud/DashScope credentials for the intended provider integration, while the registry metadata lists no required credentials.

Skill content

Set `DASHSCOPE_API_KEY` in your environment, or add `dashscope_api_key` to `~/.alibabacloud/credentials`.

Recommendation

Use a scoped DashScope key where possible, keep it out of shared files, and monitor usage or billing after running image-edit tasks.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing an unpinned SDK can change behavior over time depending on the package version retrieved.

Why it was flagged

The setup instructions ask the user to install the external DashScope package in a virtual environment; this is purpose-aligned, but the package version is not pinned.

Skill content

python -m pip install dashscope

Recommendation

Install in the virtual environment as instructed and consider pinning a reviewed DashScope version for repeatable use.

Note

ASI06: Memory and Context Poisoning

What this means

Local output files may retain sensitive prompt text, image URLs, or generated-result links after the task is complete.

Why it was flagged

The skill intentionally persists prompts, image references or result URLs, and model parameters for evidence and reproducibility.

Skill content

Save edit request payloads, result URLs, and model parameters under `output/alicloud-ai-image-qwen-image-edit/`. Keep one sample request/response pair for reproducibility.

Recommendation

Review or delete saved output files when they contain private images, private URLs, or sensitive editing instructions.