qwenz-image-gen

PassAudited by ClawScan on May 1, 2026.

Overview

This image-generation skill is coherent and purpose-aligned, but it uses your Alibaba DashScope API key and sends prompts to Alibaba's service.

This skill appears safe to use for its stated purpose. Before installing, make sure you trust Alibaba DashScope for your prompts, use an API key you are comfortable authorizing for image generation, and avoid placing sensitive information in prompts or plaintext configuration files.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

The skill can use your Alibaba DashScope account credentials, which may consume quota or incur charges.

Why it was flagged

The script reads a DashScope API key from the environment or TOOLS.md and uses it as a bearer token for the image-generation API.

Skill content

key = os.environ.get("DASHSCOPE_API_KEY") ... match = re.search(r'DASHSCOPE_API_KEY:\\s*(\\S+)', content) ... "Authorization": f"Bearer {api_key}"

Recommendation

Use a dedicated, least-privileged API key if possible, keep it private, and remove it from TOOLS.md or the environment when no longer needed.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Your image prompt and generation settings are transmitted to Alibaba Cloud.

Why it was flagged

The script sends the user-provided prompt and generation parameters to Alibaba DashScope, which is expected for this image-generation purpose.

Skill content

conn = http.client.HTTPSConnection("dashscope.aliyuncs.com", timeout=120) ... conn.request("POST", "/api/v1/services/aigc/multimodal-generation/generation", body=json.dumps(payload), headers=headers)

Recommendation

Avoid putting private, confidential, or regulated information into prompts unless you are comfortable sharing it with the provider under its terms.