Taizi Alicloud Ai Image

Generate images with Model Studio DashScope SDK using Qwen Image generation models (qwen-image-max, qwen-image-plus-2026-01-09). Use when implementing or doc...

This skill appears to legitimately implement Alicloud (DashScope) image generation with Qwen models, but it will require and try to load a DASHSCOPE_API_KEY (from the DASHSCOPE_API_KEY env var or ~/.alibabacloud/credentials) and will also load .env files from the current directory and repo root. Before installing or running: 1) do not put sensitive keys into shared .env or workspace files unless you trust the skill; 2) verify the DASHSCOPE_API_KEY you provide has minimal permissions and is rotated if shared; 3) review the included scripts (they download images from URLs and will make network calls) and ensure that behavior is acceptable; and 4) note the registry metadata omission (no required env declared) — you should ensure the platform prompts for the API key or add it manually. Overall this looks functionally correct, but the undeclared credential access is a meaningful inconsistency.

Type: OpenClaw Skill Name: taizi-alicloud-ai-image Version: 1.0.0 The skill facilitates image generation via Alibaba Cloud's DashScope SDK but contains high-risk behaviors and a vulnerability. The script `scripts/generate_image.py` automatically searches for and reads sensitive API keys from `~/.alibabacloud/credentials`. Additionally, the `resolve_reference_image` function allows for arbitrary local file reads by checking if a provided string is a file path and reading its bytes without sanitization; this could be exploited to exfiltrate sensitive files (e.g., SSH keys) to the model provider's API if the `reference_image` parameter is manipulated.