Ms Qwen Vl

• Analyzed: May 12, 2026, 3:18 AM
• Findings: 1
• Version: 0.1.0
• Hash: 75b2b676deda526361be9cf4e5cdc7254c87764766429fb9604d35d3c0950540
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to its inherent high-risk capabilities, specifically local file read and write access within `scripts/ms_qwen_vl.py`. While these capabilities (reading local image files for analysis and writing results to local files) are plausibly needed for the skill's stated purpose of visual analysis, they present a potential attack surface. There is no clear evidence of intentional malicious behavior such as data exfiltration to unauthorized endpoints, persistence mechanisms, or explicit prompt injection attempts against the OpenClaw agent in `SKILL.md` to perform actions beyond its stated purpose. The API key is handled via environment variables and sent to a legitimate ModelScope API endpoint.