Aliyun Zimage Turbo

Use when generating images with Alibaba Cloud Model Studio Z-Image Turbo (z-image-turbo) via DashScope multimodal-generation API. Use when creating text-to-i...

Security Scan

The skill's code and instructions match its stated purpose (calling Alibaba DashScope z-image-turbo to generate images); minor metadata and scope-notes are present but nothing indicates intentional misdirection or exfiltration.

Purpose & Capability

The skill's name/description (Z-Image Turbo via DashScope) align with the provided script and API references. One inconsistency: registry metadata lists no required env vars, while SKILL.md and the script explicitly require DASHSCOPE_API_KEY (or a dashscope_api_key in ~/.alibabacloud/credentials). This is likely an omission in registry metadata rather than malicious behavior.

Instruction Scope

SKILL.md instructions and the script stay within the stated scope: build request payloads, call the DashScope endpoints, download the returned image, and save artifacts. The script does load .env files (current directory and repo root) and ~/.alibabacloud/credentials to find the API key — this is expected for convenience but means it will read repository .env and user credentials files if present.

Install Mechanism

No install spec (instruction-only + a helper script). Nothing is downloaded or executed from third-party URLs during install.

Credentials

Access to DASHSCOPE_API_KEY (and optional profile env vars like ALIBABA_CLOUD_PROFILE/ALICLOUD_PROFILE) is proportionate to contacting the DashScope API. Minor concerns: the script allows overriding base_url via request or DASHSCOPE_BASE_URL (useful for testing but could point to an arbitrary endpoint if misconfigured) and it will load .env files and ~/.alibabacloud/credentials — verify those files don't contain unrelated secrets you don't want used.

Persistence & Privilege

Skill is not always-enabled, doesn't modify other skills or global agent configs, and only writes output artifacts to the designated output directory. Autonomous invocation is allowed (default) but that's expected for skills.

Assessment

This skill appears to do what it says: call Alibaba's DashScope z-image-turbo API and save images. Before installing/using it: (1) ensure you are comfortable providing a DASHSCOPE_API_KEY (set it in the environment rather than leaving it only in repository .env files); (2) inspect ~/.alibabacloud/credentials and any repository .env files the script might load so you don't unintentionally expose other secrets; (3) be cautious if you or the agent override base_url — verify it points to the official DashScope endpoints; (4) note the registry metadata omission (it doesn't declare DASHSCOPE_API_KEY) — consider asking the publisher to correct the metadata. If you plan to run the included script, review it (it uses urllib to POST and to download the returned image) and run in a controlled environment.

Category: provider

Model Studio Z-Image Turbo

Use Z-Image Turbo for fast text-to-image generation via the DashScope multimodal-generation API.

Critical model name

Use ONLY this exact model string:

• z-image-turbo

Prerequisites

• Set DASHSCOPE_API_KEY in your environment, or add dashscope_api_key to ~/.alibabacloud/credentials (env takes precedence).
• Choose region endpoint (Beijing or Singapore). If unsure, pick the most reasonable region or ask the user.

Normalized interface (image.generate)

Request

• prompt (string, required)
• size (string, optional) e.g. 1024*1024
• seed (int, optional)
• prompt_extend (bool, optional; default false)
• base_url (string, optional) override API endpoint

Response

• image_url (string)
• width (int)
• height (int)
• prompt (string)
• rewritten_prompt (string, optional)
• reasoning (string, optional)
• request_id (string)

Quick start (curl)

curl -sS 'https://dashscope.aliyuncs.com/api/v1/services/aigc/multimodal-generation/generation' \
  -H 'Content-Type: application/json' \
  -H "Authorization: Bearer $DASHSCOPE_API_KEY" \
  -d '{
    "model": "z-image-turbo",
    "input": {
      "messages": [
        {
          "role": "user",
          "content": [{"text": "A calm lake at dawn, a lone angler casting a line, cinematic lighting"}]
        }
      ]
    },
    "parameters": {
      "size": "1024*1024",
      "prompt_extend": false
    }
  }'

Local helper script

python skills/ai/image/aliyun-zimage-turbo/scripts/generate_image.py \
  --request '{"prompt":"a fishing scene at dawn, cinematic, realistic","size":"1024*1024"}' \
  --output output/ai-image-zimage-turbo/images/fishing.png \
  --print-response

Size notes

• Total pixels must be between 512*512 and 2048*2048.
• Prefer common sizes like 1024*1024, 1280*720, 1536*864.

Cost note

• prompt_extend=true is billed higher than false. Only enable when you need rewritten prompts.

Output location

• Default output: output/ai-image-zimage-turbo/images/
• Override base dir with OUTPUT_DIR.

Validation

mkdir -p output/aliyun-zimage-turbo
for f in skills/ai/image/aliyun-zimage-turbo/scripts/*.py; do
  python3 -m py_compile "$f"
done
echo "py_compile_ok" > output/aliyun-zimage-turbo/validate.txt

Pass criteria: command exits 0 and output/aliyun-zimage-turbo/validate.txt is generated.

Output And Evidence

• Save artifacts, command outputs, and API response summaries under output/aliyun-zimage-turbo/.
• Include key parameters (region/resource id/time range) in evidence files for reproducibility.

Workflow

1. Confirm user intent, region, identifiers, and whether the operation is read-only or mutating.
2. Run one minimal read-only query first to verify connectivity and permissions.
3. Execute the target operation with explicit parameters and bounded scope.
4. Verify results and save output/evidence files.

References

• references/api_reference.md for request/response schema and regional endpoints.
• references/sources.md for official docs.