Aliyun Qwen Deep Research
PassAudited by ClawScan on May 10, 2026.
Overview
This skill is coherent and purpose-aligned, but users should notice that it installs the Alibaba DashScope SDK, uses an Alibaba Cloud API key, and saves research request/output files locally.
This appears safe to install if you intend to use Alibaba Cloud Qwen Deep Research. Use a virtual environment for the SDK, protect your DashScope API key, remember that research topics and image URLs may be sent to Alibaba Cloud when you run the provider workflow, and clean up the local output folder if it contains sensitive material.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Installing the SDK changes the local Python environment and depends on the authenticity of the downloaded package.
The skill documents installing the provider SDK from Python package infrastructure; this is expected for Alibaba Cloud integration but is unpinned and user-directed.
python -m pip install dashscope
Install it in the documented virtual environment, consider pinning or verifying the package version in controlled environments, and avoid installing it globally.
Using the skill may consume Alibaba Cloud API quota or incur costs under the configured account.
The skill uses Alibaba Cloud credentials for the intended provider service. This is purpose-aligned, but users should understand that the key enables account-backed API use.
Set `DASHSCOPE_API_KEY` in your environment, or add `dashscope_api_key` to `~/.alibabacloud/credentials`.
Use a least-privileged API key where possible, protect the credentials file, and monitor provider usage and billing.
Private research questions, constraints, or generated reports may remain on disk after the task finishes.
The skill explicitly persists research inputs and outputs locally. This is disclosed and scoped, but those files may contain sensitive topics or conclusions.
Save research goals, confirmation answers, normalized request payloads, and final report snapshots under `output/aliyun-qwen-deep-research/`.
Avoid putting secrets in research topics or attachments, review the generated output directory, and delete files when they are no longer needed.