Qwen Video (Wan)

Generate videos using Alibaba Cloud DashScope Wan (通义万相) text-to-video (t2v) API (e.g., wan2.6-t2v). Use when the user asks to create a short video from a te...

Security Scan

The skill implements the advertised Alibaba DashScope Wan text-to-video workflow, but its registry metadata omits required credentials and binaries and the scripts use unsafe curl options (-k); these inconsistencies and small security issues warrant caution.

Purpose & Capability

The skill's purpose (submit/poll/download t2v jobs to DashScope Wan) matches the scripts' behavior, but the registry metadata claims no required env vars or binaries while the SKILL.md and scripts clearly require DASHSCOPE_API_KEY and command-line tools (curl, bash, python3). The missing metadata declarations are an incoherence: a video-submit skill legitimately needs the API key and networking tools, so the manifest should list them.

Instruction Scope

SKILL.md and the included scripts limit themselves to submitting an async job, polling status, and downloading the mp4 (expected). However: (1) all curl invocations include -k which disables TLS verification (weakens transport security); (2) submit.sh constructs JSON by interpolating user-supplied prompt and other fields without strict escaping (could break or be abused if prompts contain quotes/newlines); (3) scripts write downloaded media to arbitrary filesystem paths (expected for a downloader but the user should be aware). The instructions do not attempt to read unrelated files or secrets beyond the API key.

Install Mechanism

No install spec is present (instruction-only with shipped scripts). That is the lowest-risk install pattern. The only risk is that the runtime requires command-line tools which are not declared in registry metadata (see purpose_capability).

Credentials

The scripts and SKILL.md require a single credential, DASHSCOPE_API_KEY, which is proportionate to the stated purpose. The problem is the registry metadata does not declare this required env var (it lists none). Also the skill does not request other unrelated secrets, which is good.

Persistence & Privilege

The skill does not request always:true and does not modify other skills or system-wide settings. It runs on demand and writes only its output media to the filesystem (as expected).

What to consider before installing

This skill appears to do what it says (submit a DashScope Wan t2v job, poll it, and download the mp4), but there are several things you should consider before installing or running it: - Metadata mismatch: The registry claims no required environment variables or binaries, yet the SKILL.md and scripts require DASHSCOPE_API_KEY and CLI tools (curl, bash, python3). Treat the manifest as incomplete and verify you provide only a key with least privilege. - TLS verification disabled: The scripts use curl -k which skips certificate validation. Prefer removing -k to ensure TLS certificates are checked, or only run the scripts in a trusted network if you cannot change them. - Prompt / JSON handling: submit.sh interpolates prompt text directly into JSON; avoid running untrusted prompts that might break the JSON or include unexpected characters. Consider sanitizing or escaping input before use. - Filesystem writes: The skill will download and write video files to paths you specify. Ensure you choose a safe output path and run in an environment where writing is acceptable (e.g., not a sensitive system directory). Recommended actions: review the scripts locally, add DASHSCOPE_API_KEY to the skill manifest or your environment, ensure curl and python3 are installed, remove the -k flags or validate certificates, and consider running first in an isolated environment. If the publisher can update the package metadata to declare required env vars and binaries and remove -k, the incoherence would be resolved and my confidence would increase.

Qwen / Wan Video (DashScope) — 文生视频

This skill provides simple CLI scripts to:

1. submit an async Wan t2v job
2. poll task status until SUCCEEDED/FAILED
3. download the resulting mp4

Requirements

• Set API key:

export DASHSCOPE_API_KEY="sk-..."

Quick start (one command)

Generate a video and download to Windows Desktop (WSL2):

bash {baseDir}/scripts/generate.sh \
  --prompt "4秒赛博朋克雨夜城市镜头，霓虹反射，电影感镜头运动，高清" \
  --duration 4 \
  --size 1280*720 \
  --out "/mnt/c/Users/<USERNAME>/Desktop/wan_video.mp4"

Submit only (returns task_id)

bash {baseDir}/scripts/submit.sh --prompt "..." --duration 4 --size 1280*720

Poll status only

bash {baseDir}/scripts/poll.sh --task-id "<task_id>"

高级功能

多镜头叙事 (Multi-shot)

仅 wan2.6 系列模型支持此功能。通过设置 prompt_extend: true 和 shot_type: "multi" 启用。

curl --location 'https://dashscope.aliyuncs.com/api/v1/services/aigc/video-generation/video-synthesis' \
  -H 'X-DashScope-Async: enable' \
  -H "Authorization: Bearer $DASHSCOPE_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "model": "wan2.6-t2v",
    "input": {
      "prompt": "史诗级战斗场景..."
    },
    "parameters": {
      "size": "1280*720",
      "prompt_extend": true,
      "duration": 10,
      "shot_type": "multi"
    }
  }'

自动配音 (Auto Audio)

仅 wan2.6 和 wan2.5 系列模型支持。若不提供 input.audio_url，模型将根据视频内容自动生成匹配的背景音乐或音效。

curl --location 'https://dashscope.aliyuncs.com/api/v1/services/aigc/video-generation/video-synthesis' \
  -H 'X-DashScope-Async: enable' \
  -H "Authorization: Bearer $DASHSCOPE_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "model": "wan2.5-t2v-preview",
    "input": {
      "prompt": "史诗级战斗场景..."
    },
    "parameters": {
      "size": "832*480",
      "prompt_extend": true,
      "duration": 10
    }
  }'

传入音频文件 (Custom Audio)

仅 wan2.6 和 wan2.5 系列模型支持。通过 input.audio_url 参数传入自定义音频的 URL。

curl --location 'https://dashscope.aliyuncs.com/api/v1/services/aigc/video-generation/video-synthesis' \
  -H 'X-DashScope-Async: enable' \
  -H "Authorization: Bearer $DASHSCOPE_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "model": "wan2.5-t2v-preview",
    "input": {
      "prompt": "史诗级战斗场景...",
      "audio_url": "https://example.com/audio.mp3"
    },
    "parameters": {
      "size": "832*480",
      "prompt_extend": true,
      "duration": 10
    }
  }'

生成无声视频 (Silent Video)

仅 wan2.2 和 wanx2.1 系列模型支持生成无声视频。默认生成无声视频，无需设置。

wan2.6 及 wan2.5 系列模型默认生成有声视频。

curl --location 'https://dashscope.aliyuncs.com/api/v1/services/aigc/video-generation/video-synthesis' \
  -H 'X-DashScope-Async: enable' \
  -H "Authorization: Bearer $DASHSCOPE_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "model": "wan2.2-t2v-plus",
    "input": {
      "prompt": "低对比度，复古70年代风格地铁站..."
    },
    "parameters": {
      "size": "832*480",
      "prompt_extend": true
    }
  }'

使用反向提示词 (Negative Prompt)

通过 negative_prompt 排除不需要的元素。

curl --location 'https://dashscope.aliyuncs.com/api/v1/services/aigc/video-generation/video-synthesis' \
  -H 'X-DashScope-Async: enable' \
  -H "Authorization: Bearer $DASHSCOPE_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "model": "wan2.2-t2v-plus",
    "input": {
      "prompt": "一只小猫在月光下奔跑",
      "negative_prompt": "花朵"
    },
    "parameters": {
      "size": "832*480"
    }
  }'

API Endpoint (current)

• Submit: POST https://dashscope.aliyuncs.com/api/v1/services/aigc/video-generation/video-synthesis
• Status: GET https://dashscope.aliyuncs.com/api/v1/tasks/<task_id>

Scripts print:

• TASK_ID: ...
• VIDEO_URL: ... (when succeeded)
• MEDIA: <local_path> (when downloaded)

模型功能对照表

模型	多镜头叙事	自动配音	自定义音频	无声视频	反向提示词
wan2.6-t2v	✅	✅	✅	-	✅
wan2.5-t2v-preview	-	✅	✅	-	✅
wan2.2-t2v-plus	-	-	-	✅	✅
wanx2.1	-	-	-	✅	-