Ms Qwen Vl

调用魔搭社区（ModelScope）Qwen3-VL 多模态 API 进行视觉解析。使用 OpenAI SDK 兼容方式调用，支持图片内容描述、OCR 文字提取、视觉问答、对象检测等功能。用户提到"魔搭"、"ModelScope"、"Qwen-VL"、"多模态视觉"、"解析图片"等关键词时应触发。

Key points before installing: - Metadata inconsistency: the registry claims no required env vars, but the skill and scripts require MODELSCOPE_API_KEY (and optionally model-related env vars). Expect to provide a ModelScope API key. Verify where you will store that key (scripts/.env vs .env mismatch in docs). - Data exfiltration risk: the script base64-encodes local image files and sends them to https://api-inference.modelscope.cn/v1. If you run this skill (or let an agent run it) and point it at files on your computer, those images will be transmitted to a third-party service. Do not use it on sensitive images unless you trust the ModelScope service and your network. - Execution behavior: SKILL.md encourages running the bundled Python script to handle local files. If you enable autonomous agent invocation, the agent could execute the script and thereby read local image paths you mention. Consider limiting agent autonomy or running the tool manually in a controlled environment. - Dependency & path mismatches: the bundle includes requirements.txt (openai, Pillow, python-dotenv) but no automated installer; follow README to install dependencies. The README and SKILL.md reference different .env file paths (root vs scripts/); confirm which path you will use and where the API key is loaded from. - Verify the endpoint & code: if you require stronger guarantees, review the ms_qwen_vl.py code (it is included) and confirm the base_url and request behavior meet your security and privacy requirements. If needed, run the tool in an isolated sandbox or on non-sensitive sample images first.

Type: OpenClaw Skill Name: ms-qwen-vl Version: 0.1.0 The skill is classified as suspicious due to its inherent high-risk capabilities, specifically local file read and write access within `scripts/ms_qwen_vl.py`. While these capabilities (reading local image files for analysis and writing results to local files) are plausibly needed for the skill's stated purpose of visual analysis, they present a potential attack surface. There is no clear evidence of intentional malicious behavior such as data exfiltration to unauthorized endpoints, persistence mechanisms, or explicit prompt injection attempts against the OpenClaw agent in `SKILL.md` to perform actions beyond its stated purpose. The API key is handled via environment variables and sent to a legitimate ModelScope API endpoint.