Security audit
Security checks for vulnerabilities and agentic risk
This is a small Qwen image-generation helper that sends prompts to Alibaba Cloud DashScope as expected, with no hidden code or persistence found.
Before installing, understand that generated-image prompts are sent to Alibaba Cloud DashScope using your DASHSCOPE_API_KEY and may incur provider billing. Do not include secrets, private personal data, regulated data, or confidential business material in prompts unless you have approved that third-party processing and selected the appropriate regional endpoint.
The description says to use the skill when the user asks AI to '生成图片、画图、文生图、text-to-image，或提到千问、阿里云生图'. Several of these triggers are broad everyday requests, and '提到千问' is especially ambiguous because merely mentioning Qwen does not clearly indicate an intent to invoke this image-generation skill. The file does not provide exclusion conditions or negative examples to narrow activation scope.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
使用 qwen-image-2.0-pro 模型（效果最佳）：
curl -X POST 'https://dashscope.aliyuncs.com/api/v1/services/aigc/multimodal-generation/generation' \
-H 'Content-Type: application/json' \
-H "Authorization: Bearer $DASHSCOPE_API_KEY" \
-d '{
The curl example demonstrates a live authenticated POST to an external image-generation service using user-supplied prompt content and an API key, with no warning about external disclosure. Because this skill is specifically for text-to-image generation, the transmitted content may include sensitive business, personal, or policy-restricted material if callers are not informed or constrained.
| parameters.watermark | boolean | 否 | 添加水印，默认 false | | parameters.seed | integer | 否 | 随机种子，范围 [0, 2147483647] |
curl -X POST 'https://dashscope.aliyuncs.com/api/v1/services/aigc/multimodal-generation/generation' \
The documentation instructs users to send prompts and API-authenticated requests to Alibaba Cloud endpoints but does not warn that user prompts, negative prompts, and related metadata will be transmitted to a third-party service. In a skill that may be invoked with arbitrary user content, this omission can cause unintentional disclosure of sensitive or regulated data to an external processor.
Detected: suspicious.exposed_secret_literal