Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Alibaba Dashscope Local

v1.0.0

Configure OpenClaw to use Alibaba Cloud Bailian provider (Pay-As-You-Go or Coding Plan) through a strict interactive flow. Supports 5 site options and flagsh...

0· 22·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for papabearclaw/alibaba-dashscope-local.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Alibaba Dashscope Local" (papabearclaw/alibaba-dashscope-local) from ClawHub.
Skill page: https://clawhub.ai/papabearclaw/alibaba-dashscope-local
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Canonical install target

openclaw skills install papabearclaw/alibaba-dashscope-local

ClawHub CLI

Package manager switcher

npx clawhub@latest install alibaba-dashscope-local
Security Scan
Capability signals
CryptoCan make purchasesRequires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description align with the included script and SKILL.md: the package configures an OpenClaw 'bailian' provider, detects/writes OpenClaw config files, and exposes options for plan/site/model. The one notable capability beyond a simple JSON edit is optional persistence of an API key into shell profiles or a systemd user override; this is related to storing the API key but is broader than a minimal 'provider config' tool and should be considered before use.
Instruction Scope
SKILL.md instructs the agent to run the bundled Python script and lists flags and safety checks. The script performs expected actions: prompt/collect API key, validate it against the selected base URL, backup and update OpenClaw JSON, and validate JSON after write. It also offers non-interactive listing and validation modes. No instructions send data to unexpected external endpoints beyond the documented dashscope/coding dashscope URLs.
Install Mechanism
No install spec or external downloads; the skill is instruction-only with a bundled Python script. Nothing is fetched from arbitrary URLs or installed into system paths by the skill itself.
Credentials
Registry metadata declares no required env vars, yet the script strongly recommends and defaults to an environment variable named DASHSCOPE_API_KEY and supports inline storage. Requesting and validating an API key is proportionate to the stated purpose, but the metadata not listing that credential is an inconsistency the user should notice.
!
Persistence & Privilege
The script writes to user config files (~/.openclaw/openclaw.json etc.) which is expected. However it also offers flags to persist the API key into shell profiles (~/.bashrc by default), to write systemd user overrides, and to restart a systemd user service. Those operations modify system-level user configuration and can restart services; they are powerful and should only be run with explicit user consent and review of the exact modifications.
What to consider before installing
What to check before installing or running this skill: - Source trust: The package's homepage/source is unknown. Treat it like unaudited third-party code until you can verify the author. - Inspect the script: Review scripts/alibaba_cloud_model_setup.py yourself (it is bundled) to confirm exactly what it writes into your config, shell profile, and any systemd unit files. Pay attention to any subprocess calls (the script imports subprocess) and what commands it may run when using the --persist-env-systemd or --persist-env-shell flags. - API key handling: The script expects a DashScope API key (default env var DASHSCOPE_API_KEY). Prefer environment-variable mode over inline storage. Do not allow inline storage of secrets into config files unless you accept the risk. - Minimize side effects: Run first with safe options: --list-models and --non-interactive (or run the script in a test container/sandbox) to see behavior without writing files. Do not use --persist-env-systemd or --persist-env-shell unless you reviewed the exact lines it will add and you understand restarting the openclaw user service. - Backup and verify: The script claims to back up existing configs before writing; still make a manual backup of ~/.openclaw/openclaw.json (and any other detected config) before running. After running, validate JSON (python3 -m json.tool) and inspect what changed. - If unsure, run in a disposable environment: e.g., a throwaway VM or container where changes are reversible. If you want, I can list the places in the bundled script where it writes files or invokes subprocesses so you can review exact behavior before running.

Like a lobster shell, security has layers — review code before you run it.

latestvk97fg6rydg5r862a67c3x576tx85dd6c
22downloads
0stars
1versions
Updated 5h ago
v1.0.0
MIT-0

Alibaba Cloud Model Setup (Bailian)

Overview

Use this skill to configure Alibaba Cloud Bailian as an OpenClaw model provider with minimal manual editing. Supports both Pay-As-You-Go (按量付费) and Coding Plan (订阅制) subscription types.

Key Features

1️⃣ Fixed Provider Name

  • Provider: bailian (not "balian" - typo fixed!)

2️⃣ 5 Site Options

Plan TypeSiteBase URL
Pay-As-You-GoChina (CN)https://dashscope.aliyuncs.com/compatible-mode/v1
Pay-As-You-GoInternational (INTL)https://dashscope-intl.aliyuncs.com/compatible-mode/v1
Pay-As-You-GoUS (US)https://dashscope-us.aliyuncs.com/compatible-mode/v1
Coding PlanChina (CN)https://coding.dashscope.aliyuncs.com/v1
Coding PlanInternational (INTL)https://coding-intl.dashscope.aliyuncs.com/v1

3️⃣ Flagship Model Series (4 series, 2-3 generations each)

Qwen-Max (Best Performance):

  • qwen-max
  • qwen-max-2025-01-25

Qwen-Plus (Balanced):

  • qwen-plus
  • qwen-plus-2025-01-15

Qwen-Flash (Fast & Cost-Effective):

  • qwen-flash
  • qwen-flash-2025-01-15

Qwen-Coder (Code Specialist):

  • qwen3-coder-plus
  • qwen3-coder-next
  • qwen2.5-coder-32b-instruct

4️⃣ Latest Qwen Models (Available for All Users)

  • qwen3.5-plus
  • qwen3-max-2026-01-23

5️⃣ Coding Plan Exclusive Models (Third-Party)

  • MiniMax-M2.5 (MiniMax)
  • glm-5 / glm-4.7 (智谱 AI)
  • kimi-k2.5 (月之暗面)

Total:

  • Pay-As-You-Go: 11 models (4 flagship series + 2 latest Qwen)
  • Coding Plan: 15 models (Pay-As-You-Go + 4 third-party exclusive)

Workflow

  1. Confirm plan type: Pay-As-You-Go or Coding Plan
  2. Select site: Based on plan type (3 options for Pay-As-You-Go, 2 for Coding Plan)
  3. Run interactive script to collect:
    • API key (with validation)
    • API key storage mode (env-var recommended or inline)
    • Primary model selection
    • Whether to set as default model
  4. Validate API key against selected site before config write
  5. Backup existing config before modification
  6. Update config with provider, models, and defaults
  7. Validate JSON and report final status

Run Script

Execute:

python3 scripts/alibaba_cloud_model_setup.py

Optional flags for non-interactive use:

python3 scripts/alibaba_cloud_model_setup.py \
  --plan-type coding \
  --site cn \
  --api-key-source env \
  --env-var DASHSCOPE_API_KEY \
  --models qwen3.5-plus,qwen3-max-2026-01-23,qwen3-coder-plus \
  --model qwen3.5-plus \
  --set-default

List available models (no config write):

python3 scripts/alibaba_cloud_model_setup.py \
  --plan-type coding \
  --site cn \
  --list-models \
  --non-interactive

Safety Rules (Mandatory)

  1. Always run python3 scripts/alibaba_cloud_model_setup.py for configuration changes.
  2. Never edit ~/.openclaw/openclaw.json manually when this skill is used.
  3. Always validate API key before writing config.
  4. Always create backup before overwriting existing config.
  5. In environment-variable mode, never proceed to config write unless env detection succeeds.

Default Behavior

  • Detect config path in this order:
    • ~/.openclaw/openclaw.json
    • ~/.moltbot/moltbot.json
    • ~/.clawdbot/clawdbot.json
  • If none exists, create ~/.openclaw/openclaw.json
  • Write provider bailian with OpenAI-compatible API mode
  • Create a timestamped backup before overwriting an existing file
  • Preserve unrelated config sections
  • Set models.mode to merge to preserve other providers

Validation Checklist

After configuration:

  1. Confirm JSON is valid by running python3 -m json.tool <config-path>.
  2. Ensure models.providers.bailian.baseUrl matches site selection.
  3. Ensure models.providers.bailian.models contains expected model IDs.
  4. Ensure agents.defaults.model.primary is bailian/<model-id> when default is enabled.
  5. Start dashboard (openclaw dashboard) or TUI (openclaw tui) and verify model call succeeds.

Example Config Output

Coding Plan China Site

{
  "models": {
    "mode": "merge",
    "providers": {
      "bailian": {
        "baseUrl": "https://coding.dashscope.aliyuncs.com/v1",
        "apiKey": "YOUR_API_KEY",
        "api": "openai-completions",
        "models": [
          {
            "id": "qwen3.5-plus",
            "name": "Qwen3.5 Plus",
            "reasoning": false,
            "input": ["text", "image"],
            "cost": { "input": 0, "output": 0, "cacheRead": 0, "cacheWrite": 0 },
            "contextWindow": 1000000,
            "maxTokens": 65536
          },
          {
            "id": "qwen3-max-2026-01-23",
            "name": "Qwen3 Max 2026-01-23",
            "reasoning": false,
            "input": ["text"],
            "cost": { "input": 0, "output": 0, "cacheRead": 0, "cacheWrite": 0 },
            "contextWindow": 262144,
            "maxTokens": 65536
          },
          {
            "id": "qwen3-coder-next",
            "name": "Qwen3 Coder Next",
            "reasoning": false,
            "input": ["text"],
            "cost": { "input": 0, "output": 0, "cacheRead": 0, "cacheWrite": 0 },
            "contextWindow": 262144,
            "maxTokens": 65536
          },
          {
            "id": "qwen3-coder-plus",
            "name": "Qwen3 Coder Plus",
            "reasoning": false,
            "input": ["text"],
            "cost": { "input": 0, "output": 0, "cacheRead": 0, "cacheWrite": 0 },
            "contextWindow": 1000000,
            "maxTokens": 65536
          },
          {
            "id": "MiniMax-M2.5",
            "name": "MiniMax M2.5",
            "reasoning": false,
            "input": ["text"],
            "cost": { "input": 0, "output": 0, "cacheRead": 0, "cacheWrite": 0 },
            "contextWindow": 204800,
            "maxTokens": 131072
          },
          {
            "id": "glm-5",
            "name": "GLM-5",
            "reasoning": false,
            "input": ["text"],
            "cost": { "input": 0, "output": 0, "cacheRead": 0, "cacheWrite": 0 },
            "contextWindow": 202752,
            "maxTokens": 16384
          },
          {
            "id": "glm-4.7",
            "name": "GLM-4.7",
            "reasoning": false,
            "input": ["text"],
            "cost": { "input": 0, "output": 0, "cacheRead": 0, "cacheWrite": 0 },
            "contextWindow": 202752,
            "maxTokens": 16384
          },
          {
            "id": "kimi-k2.5",
            "name": "Kimi K2.5",
            "reasoning": false,
            "input": ["text", "image"],
            "cost": { "input": 0, "output": 0, "cacheRead": 0, "cacheWrite": 0 },
            "contextWindow": 262144,
            "maxTokens": 32768
          }
        ]
      }
    }
  },
  "agents": {
    "defaults": {
      "model": {
        "primary": "bailian/qwen3.5-plus"
      },
      "models": {
        "bailian/qwen3.5-plus": {},
        "bailian/qwen3-max-2026-01-23": {},
        "bailian/qwen3-coder-next": {},
        "bailian/qwen3-coder-plus": {},
        "bailian/MiniMax-M2.5": {},
        "bailian/glm-5": {},
        "bailian/glm-4.7": {},
        "bailian/kimi-k2.5": {}
      }
    }
  }
}

References

  • Endpoint and field conventions: references/openclaw_alibaba_cloud.md

Version: 0.1.4
Updated: 2026-03-02
Changes: Fixed provider name typo (balian → bailian), added Coding Plan support, 5 site options, 11 models for Pay-As-You-Go (flagship + latest Qwen), 15 models for Coding Plan (+4 third-party exclusive)

Comments

Loading comments...