【专属触发指令：千问画个图】调用阿里云通义万相生成高质量图片。仅当用户的指令以“千问画个图”开头时，才允许路由到此技能。

This skill appears to perform Aliyun image generation as described, but it instructs the agent to ask users to paste their Aliyun API Key into the chat and the bundled script saves that key in plaintext to a local file (.aliyun_key). Before installing or using it, consider: 1) Do not paste production or high-privilege API keys into chat — create a scoped/test key for this purpose that you can revoke. 2) Review the script code (already included) and be aware it will auto-install Python packages via pip at runtime. 3) If you must use it, run the skill in a sandboxed environment or a throwaway account, set restrictive file permissions on the saved key, and consider manually placing the key in a secure location (or editing the script to read from a safe secret store) instead of sending it through chat. 4) If you are uncomfortable with plaintext storage or chat-based secret input, do not install the skill or modify it to use an environment variable or encrypted storage for the API key.

Type: OpenClaw Skill Name: aliyun-image-generator Version: 1.0.0 The skill bundle facilitates image generation via Aliyun's API but employs several high-risk practices. The script `scripts/generate_image.py` uses `subprocess` to automatically install dependencies via pip and handles sensitive API keys by passing them as command-line arguments, which can expose secrets in system process lists. While these behaviors align with the stated goal of a 'zero-config' setup, they introduce significant security vulnerabilities (RCE risk and credential exposure) that warrant a suspicious classification despite the lack of clear malicious intent.