qwencloud-image-generation
Pass
Audited by Gen Agent Trust Hub on May 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements strong security practices for credential management. It explicitly instructs agents never to output API keys in plaintext, enforces non-plaintext environment checks, and guides users to manage secrets via .env files.
- [COMMAND_EXECUTION]: The
scripts/gossamer.pyscript usessubprocess.runto execute a Python script (check_update.py) located in a sibling skill directory (qwencloud-update-check). This is an internal coordination mechanism for the qwencloud skill suite to manage versioning and updates. - [EXTERNAL_DOWNLOADS]: The skill facilitates image generation and editing by communicating with official Alibaba Cloud DashScope API endpoints (
dashscope-intl.aliyuncs.com). It also supports optional user-approved updates via the commandnpx skills add QwenCloud/qwencloud-ai --skill qwencloud-update-check -y. - [DYNAMIC_EXECUTION]: The toolkit includes a discovery mechanism in
gossamer.pythat dynamically locates and executes update-checking scripts from other installed qwencloud skills. This behavior is documented and intended for maintaining the integrity and features of the vendor's AI tools.
Audit Metadata