Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

qwen-image-gen

v0.1.0

基于阿里云百炼 Qwen-Image 文生图模型的生图 skill。支持同步生成、异步任务轮询、下载生成结果到本地。 当用户需要根据提示词生成图片、批量出图、指定尺寸/比例,或继续查询已有图片生成任务时,使用此 skill。

0· 130·0 current·0 all-time
byWei Zhou@zhouweico

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for zhouweico/qwen-image-gen.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "qwen-image-gen" (zhouweico/qwen-image-gen) from ClawHub.
Skill page: https://clawhub.ai/zhouweico/qwen-image-gen
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: DASHSCOPE_API_KEY
Required binaries: node
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install qwen-image-gen

ClawHub CLI

Package manager switcher

npx clawhub@latest install qwen-image-gen
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
The skill is an image-generation client for Aliyun's Qwen-Image service. It requires Node and a DASHSCOPE_API_KEY, references dashscope.aliyuncs.com as the API host, and includes code to call the documented endpoints — these are appropriate for the described purpose.
Instruction Scope
SKILL.md instructs the agent to set DASHSCOPE_API_KEY, optionally use config.json, run the provided Node script, and download outputs to outputs/. The instructions only reference files and env vars relevant to configuring and running the image-generation flow (no unrelated file reads or external endpoints).
Install Mechanism
There is no install spec (instruction-only behavior plus an included Node script). The script relies on Node >=18 and built-in fetch; no external download/install from untrusted URLs or package registries occurs. Risk from install mechanism is low.
Credentials
The only required credential is DASHSCOPE_API_KEY (primaryEnv). That matches the documented API usage. The code may also read optional environment keys (e.g., QWEN_IMAGE_MODEL) and a local config.json; these are reasonable and proportional to configuration needs.
Persistence & Privilege
The skill does not request permanent always:true inclusion and does not attempt to modify other skills or system-wide settings. It runs as a local Node script and writes outputs to a local outputs/ directory as expected.
Assessment
This skill runs a local Node script that will call Aliyun's DashScope (Qwen-Image) APIs and download generated PNGs to an outputs/ directory. Before installing/providing credentials: 1) confirm the DASHSCOPE_API_KEY is the correct key for the intended Aliyun region (the README warns region keys/URLs cannot be mixed), 2) review the included scripts (they are present and readable) and run in an isolated environment if unsure, 3) store the API key in an environment variable rather than committing it to a repo or config file, and 4) be aware that generating images incurs cost per image per the pricing table. If you do not trust the source, do not provide high-privilege credentials or run the script on sensitive systems.
scripts/qwen-image-gen.js:313
Environment variable access combined with network send.
!
scripts/qwen-image-gen.js:151
File read combined with network send (possible exfiltration).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

Binsnode
EnvDASHSCOPE_API_KEY
Primary envDASHSCOPE_API_KEY
latestvk973y5pypw0aqrpj0k3dq8jnbx83kdat
130downloads
0stars
1versions
Updated 1mo ago
v0.1.0
MIT-0

Qwen Image Gen

通过阿里云百炼 Qwen-Image 接口生成图片。默认使用 qwen-image-2.0-pro,支持按模型自动选择同步/异步模式,并在成功后下载 PNG 到本地。

详细接口、尺寸限制、价格表见 references/api.md

Setup

  1. 配置 API Key:
export DASHSCOPE_API_KEY="sk-xxx"

也可以在 skill 目录下创建 config.json,参考 config.example.json

  1. 运行环境要求 Node.js >= 18

  2. 北京和新加坡地域使用不同的 API Key 与 Base URL,不能混用

配置优先级:

  • CLI 参数
  • 环境变量
  • config.json
  • 脚本默认值

默认模型

  • 默认模型:qwen-image-2.0-pro
  • qwen-image-2.0-proqwen-image-2.0qwen-image-max 走同步接口
  • qwen-image-plusqwen-image 走异步接口

支持范围

  • qwen-image-2.0-pro / qwen-image-2.0:支持 1-6 张,适合通用文生图
  • qwen-image-max:固定 1 张,偏真实感
  • qwen-image-plus / qwen-image:固定 1 张,支持异步任务
  • 图片输出格式为 png
  • 任务和结果链接默认保留 24 小时,拿到后要尽快下载

CLI

主要脚本:node scripts/qwen-image-gen.js

默认出图

node scripts/qwen-image-gen.js \
  --prompt="一间有着精致窗户的花店,漂亮的木质门,摆放着花朵" \
  --goal="quality"

低成本试探

node scripts/qwen-image-gen.js \
  --prompt="一个赛博朋克风格的雨夜街道" \
  --goal="cheap" \
  --n=1

异步任务

node scripts/qwen-image-gen.js \
  --prompt="复古海报风格的城市街景" \
  --model="qwen-image-plus" \
  --mode="async"

继续查询已有任务

node scripts/qwen-image-gen.js \
  --task-id="你的task_id"

仅做预检

node scripts/qwen-image-gen.js \
  --prompt="一张产品海报,主体是一瓶绿色玻璃香水" \
  --ratio="3:4" \
  --dry-run

参数约定

  • --prompt:正向提示词,提交新任务时必填
  • --negative-prompt:反向提示词,建议控制在 500 字符内
  • --goal=cheap|balanced|quality:按用户意图选择默认模型和尺寸
  • --tier=draft|standard|final:按档位选择模型
  • --model:模型名,默认 qwen-image-2.0-pro
  • --mode=auto|sync|async:自动选择或强制接口模式
  • --ratio:快捷比例
    • qwen-image-2.0*1:1 3:4 4:3 9:16 16:9
    • qwen-image-max / qwen-image-plus / qwen-image1:1 3:4 4:3 9:16 16:9
  • --size:具体分辨率,如 2048*2048
  • --n:张数
    • qwen-image-2.0*1-6
    • 其他模型:固定 1
  • --prompt-extend=true|false:是否启用提示词改写,默认 true
  • --watermark=true|false:是否添加水印,默认 false
  • --task-id:查询已有异步任务
  • --no-wait:只提交异步任务,不继续轮询
  • --poll-interval:轮询间隔秒数,默认 10
  • --timeout:总等待超时秒数,默认 600
  • --output-dir:图片下载目录,默认 outputs/
  • --name:输出文件名前缀
  • --dry-run:只打印最终请求体和配置预检

工作流

  1. 用户要生图时,优先提交新任务而不是直接假定已有结果。
  2. qwen-image-2.0-pro / qwen-image-2.0 / qwen-image-max 直接同步出图并下载。
  3. qwen-image-plus / qwen-image 走异步任务,返回 task_id 后轮询。
  4. 成功后立即下载生成结果到本地 outputs/
  5. 需要稳定复现时,显式传 --seed

价格提醒

  • 价格按中国内地单价表估算;如果使用新加坡地域,脚本会切换到国际单价表
  • 计费按成功生成的图片张数计算
  • 免费额度和单价会随官方更新变化,需同步更新脚本内置表

Comments

Loading comments...