Taizi Alicloud Ai Image

Generate images with Model Studio DashScope SDK using Qwen Image generation models (qwen-image-max, qwen-image-plus-2026-01-09). Use when implementing or doc...

Security Scan

The skill appears to implement Qwen image generation correctly, but its runtime touches undeclared credentials and environment files (DASHSCOPE_API_KEY, ~/.alibabacloud/credentials, .env) which is inconsistent with the registry metadata and should be noted before installing.

Purpose & Capability

Name/description match the code: it calls DashScope ImageGeneration with qwen-image models. However the skill metadata declares no required environment variables or primary credential, while both SKILL.md and the script require DASHSCOPE_API_KEY (or credentials in ~/.alibabacloud/credentials). That mismatch is disproportionate to the declared registry requirements.

Instruction Scope

Runtime instructions and the included script read environment variables, load .env files (from CWD and repo root found via .git), and load credentials from ~/.alibabacloud/credentials. The script also downloads reference images and generated image URLs via urllib. These behaviors are consistent with an image provider integration but the script will read local files that may contain secrets (unexpected given metadata) and will perform network fetches.

Install Mechanism

There is no automated install spec (instruction-only) which minimizes install-time risk. The SKILL.md recommends installing the dashscope Python package in a venv; the script will fail if dashscope isn't installed. No remote archives or obscure download URLs are used by the skill itself.

Credentials

The skill requires DASHSCOPE_API_KEY and supports reading dashscope_api_key from ~/.alibabacloud/credentials and ALIBABA_CLOUD_PROFILE/ALICLOUD_PROFILE, but the registry lists no required env or primary credential. The number and type of env/config accesses are reasonable for an Alibaba Cloud SDK integration, but the omission from metadata is an inconsistency the user should be aware of.

Persistence & Privilege

The skill does not request persistent 'always' inclusion and does not attempt to modify other skills or system-wide agent settings. Its runtime activity (reading env/credentials, writing output images under workspace) is within expected scope for a provider integration.

What to consider before installing

This skill appears to legitimately implement Alicloud (DashScope) image generation with Qwen models, but it will require and try to load a DASHSCOPE_API_KEY (from the DASHSCOPE_API_KEY env var or ~/.alibabacloud/credentials) and will also load .env files from the current directory and repo root. Before installing or running: 1) do not put sensitive keys into shared .env or workspace files unless you trust the skill; 2) verify the DASHSCOPE_API_KEY you provide has minimal permissions and is rotated if shared; 3) review the included scripts (they download images from URLs and will make network calls) and ensure that behavior is acceptable; and 4) note the registry metadata omission (no required env declared) — you should ensure the platform prompts for the API key or add it manually. Overall this looks functionally correct, but the undeclared credential access is a meaningful inconsistency.

Category: provider

Model Studio Qwen Image

Build consistent image generation behavior for the video-agent pipeline by standardizing image.generate inputs/outputs and using DashScope SDK (Python) with the exact model name.

Prerequisites

• Install SDK (recommended in a venv to avoid PEP 668 limits):

python3 -m venv .venv
. .venv/bin/activate
python -m pip install dashscope

• Set DASHSCOPE_API_KEY in your environment, or add dashscope_api_key to ~/.alibabacloud/credentials (env takes precedence).

Critical model names

Use one of these exact model strings:

• qwen-image-max
• qwen-image-plus-2026-01-09

Normalized interface (image.generate)

Request

• prompt (string, required)
• negative_prompt (string, optional)
• size (string, required) e.g. 1024*1024, 768*1024
• style (string, optional)
• seed (int, optional)
• reference_image (string | bytes, optional)

Response

• image_url (string)
• width (int)
• height (int)
• seed (int)

Quickstart (normalized request + preview)

Minimal normalized request body:

{
  "prompt": "a cinematic portrait of a cyclist at dusk, soft rim light, shallow depth of field",
  "negative_prompt": "blurry, low quality, watermark",
  "size": "1024*1024",
  "seed": 1234
}

Preview workflow (download then open):

curl -L -o output/ai-image-qwen-image/images/preview.png "<IMAGE_URL_FROM_RESPONSE>" && open output/ai-image-qwen-image/images/preview.png

Local helper script (JSON request -> image file):

python skills/ai/image/alicloud-ai-image-qwen-image/scripts/generate_image.py \\
  --request '{"prompt":"a studio product photo of headphones","size":"1024*1024"}' \\
  --output output/ai-image-qwen-image/images/headphones.png \\
  --print-response

Parameters at a glance

Field	Required	Notes
prompt	yes	Describe a scene, not just keywords.
negative_prompt	no	Best-effort, may be ignored by backend.
size	yes	WxH format, e.g. 1024*1024, 768*1024.
style	no	Optional stylistic hint.
seed	no	Use for reproducibility when supported.
reference_image	no	URL/file/bytes, SDK-specific mapping.

Quick start (Python + DashScope SDK)

Use the DashScope SDK and map the normalized request into the SDK call. Note: For qwen-image-max, the DashScope SDK currently succeeds via ImageGeneration (messages-based) rather than ImageSynthesis. If the SDK version you are using expects a different field name for reference images, adapt the input mapping accordingly.

import os
from dashscope.aigc.image_generation import ImageGeneration

# Prefer env var for auth: export DASHSCOPE_API_KEY=...
# Or use ~/.alibabacloud/credentials with dashscope_api_key under [default].


def generate_image(req: dict) -> dict:
    messages = [
        {
            "role": "user",
            "content": [{"text": req["prompt"]}],
        }
    ]

    if req.get("reference_image"):
        # Some SDK versions accept {"image": <url|file|bytes>} in messages content.
        messages[0]["content"].insert(0, {"image": req["reference_image"]})

    response = ImageGeneration.call(
        model=req.get("model", "qwen-image-max"),
        messages=messages,
        size=req.get("size", "1024*1024"),
        api_key=os.getenv("DASHSCOPE_API_KEY"),
        # Pass through optional parameters if supported by the backend.
        negative_prompt=req.get("negative_prompt"),
        style=req.get("style"),
        seed=req.get("seed"),
    )

    # Response is a generation-style envelope; extract the first image URL.
    content = response.output["choices"][0]["message"]["content"]
    image_url = None
    for item in content:
        if isinstance(item, dict) and item.get("image"):
            image_url = item["image"]
            break
    return {
        "image_url": image_url,
        "width": response.usage.get("width"),
        "height": response.usage.get("height"),
        "seed": req.get("seed"),
    }

Error handling

Error	Likely cause	Action
401/403	Missing or invalid DASHSCOPE_API_KEY	Check env var or ~/.alibabacloud/credentials, and access policy.
400	Unsupported size or bad request shape	Use common WxH and validate fields.
429	Rate limit or quota	Retry with backoff, or reduce concurrency.
5xx	Transient backend errors	Retry with backoff once or twice.

Output location

• Default output: output/ai-image-qwen-image/images/
• Override base dir with OUTPUT_DIR.

Operational guidance

• Store the returned image in object storage and persist only the URL in metadata.
• Cache results by (prompt, negative_prompt, size, seed, reference_image hash) to avoid duplicate costs.
• Add retries for transient 429/5xx responses with exponential backoff.
• Some backends ignore negative_prompt, style, or seed; treat them as best-effort inputs.
• If the response contains no image URL, surface a clear error and retry once with a simplified prompt.

Size notes

• Use WxH format (e.g. 1024*1024, 768*1024).
• Prefer common sizes; unsupported sizes can return 400.

Telegram / channel delivery

When the user requests image generation via Telegram (or other channels), after generating and saving the image to workspace output/ai-image-qwen-image/images/, use the message tool to send the image: action=send, target=telegram, media=<file:// URL>. Always pass explicit target when the session may have mixed sources (e.g. control-ui): extract sender_id from Conversation info metadata in user messages and use target: "<sender_id>" (e.g. target: "6869266119") to ensure delivery to the correct Telegram DM and avoid "bot is not a member of the channel chat" errors. Use file:// absolute paths (e.g. file:///Users/fresh/.openclaw/workspace/output/ai-image-qwen-image/images/xxx.png). Do not use ~/ paths.

Anti-patterns

• Do not invent model names or aliases; use official model IDs only.
• Do not store large base64 blobs in DB rows; use object storage.
• Do not omit user-visible progress for long generations.

References

• See references/api_reference.md for a more detailed DashScope SDK mapping and response parsing tips.

• See references/prompt-guide.md for prompt patterns and examples.

• For edit workflows, use skills/ai/image/alicloud-ai-image-qwen-image-edit/.

• Source list: references/sources.md