Dashscope Image Gen

Generate images via Alibaba DashScope OpenAI-compatible endpoint (compatible-mode) using qwen-image-max. Use when the user asks for 文生图/图片生成/image generation...

Security Scan

The skill appears to do what it says (generate images via the DashScope OpenAI‑compatible endpoint); there are a couple of minor metadata/instruction mismatches to be aware of but no signs of malicious behavior.

Purpose & Capability

Name/description match the implementation: the script posts to {baseUrl}/images/generations using model qwen-image-max. Minor mismatch: the skill metadata lists no required env vars, but both SKILL.md and the script expect an API key (DASHSCOPE_API_KEY or --api-key). This is proportionate to the stated purpose but should have been declared.

Instruction Scope

Runtime instructions and the script stay within the image-generation task: they build an images/generations payload, send it to the configured base URL, and write the returned image bytes to disk. The script will also attempt to read ~/.openclaw/openclaw.json as a fallback to find an API key — that is reasonable for convenience but is outside the minimal instructions and should be noted.

Install Mechanism

No install spec; this is an instruction-only skill with a small included CLI script. Nothing is downloaded or written to disk by an installer step.

Credentials

The script requires a DashScope API key to function (DASHSCOPE_API_KEY or --api-key, or an entry in ~/.openclaw/openclaw.json). Requesting a single service API key is proportionate. The skill did not declare this env var in the registry metadata — a metadata omission rather than excessive privilege. The fallback read of ~/.openclaw/openclaw.json reads the user config file to obtain the key.

Persistence & Privilege

The skill does not request always:true, does not modify other skills or system settings, and runs only when invoked. No elevated persistence or unexpected privileges observed.

Assessment

This skill appears to be coherent and implements a simple CLI that calls DashScope's compatible images API. Before installing or running: (1) be aware the script needs your DashScope API key (DASHSCOPE_API_KEY) but the registry metadata does not list it — provide the key via environment variable or config rather than the --api-key flag to avoid shell history leakage; (2) the script will read ~/.openclaw/openclaw.json as a fallback, so review that file for other secrets before reusing it; (3) confirm the base URL (https://dashscope.aliyuncs.com/compatible-mode/v1) is the expected endpoint for your account; (4) inspect the small included script yourself (it's short and readable) if you have doubts; and (5) avoid pasting high‑privilege credentials on the command line.

DashScope Image Generation (qwen-image-max)

Use this skill to generate an image from a text prompt through DashScope compatible-mode.

Quick start

Preferred (no secrets in shell history):

export DASHSCOPE_API_KEY="..."
./scripts/dashscope_image_gen.py --prompt "a cute robot, watercolor" --out robot.png

Optional params (best-effort; support depends on DashScope):

./scripts/dashscope_image_gen.py --prompt "industrial factory at night" --size 1024x1024 --n 1 --out factory.png

What to do when it fails

1. Re-run with the same command and copy the HTTP error body.
2. If the error indicates a different route/payload than OpenAI Images API:
   • Update scripts/dashscope_image_gen.py accordingly.
   • Update references/dashscope-openai-compatible.md with the correct details.

Files

• scripts/dashscope_image_gen.py: main CLI (calls POST {baseUrl}/images/generations)
• references/dashscope-openai-compatible.md: endpoint/auth notes