qwencloud-image-generation

Key points to consider before installing: - Metadata mismatch: The registry metadata claims no required environment variables, but SKILL.md and the included Python scripts require a DASHSCOPE_API_KEY (or QWEN_API_KEY). Treat this as a transparency issue — expect to provide an API key in a .env (or env var) for the skill to work. - API key handling: The skill instructs you to keep API keys out of plaintext output and to use .env; follow that. Prefer storing the API key in a .env file or secure secret store, and do not paste the key into chat or share it publicly. - Local file access / uploads: The skill will auto-upload local image files you reference to the provider's temporary storage. This is expected for an image-editing tool, but avoid referencing sensitive images you don't want uploaded. - Update-check behavior: On startup the code may run an update-check routine that can execute a local script (if present in your repo/skills). That means the skill may run other local code during initialization. If you have untrusted code in your repo/skills, either remove it or inspect the called scripts before using this skill. - Recommended actions: (1) Inspect the included scripts (image.py, qwencloud_lib.py, gossamer.py) yourself or run them in an isolated environment. (2) Only place the API key in a secure .env (and confirm the code uses os.environ rather than printing keys). (3) If you do not want automatic local-script execution, search your repo for qwencloud-update-check or the relevant scripts and remove or sandbox them. (4) Prefer running the scripts manually the first time to observe behavior before allowing any agent to invoke them autonomously. Overall: the code appears to implement the advertised image-generation functionality, but the failure to declare required credentials in metadata and the update-check subprocess execution are actionable concerns — review the code and environment handling before proceeding.