qianwen-ops-auth
[QianWen] Configure authentication (API keys, endpoints). TRIGGER when: setting up QIANWEN_API_KEY, troubleshooting 401/auth errors, when another skill reports missing credentials, or user explicitly invokes this skill by name (e.g. use qianwen-ops-auth). DO NOT TRIGGER when: non-auth Qwen tasks, general API usage questions.
Security Assessment
About qianwen-ops-auth
qianwen-ops-auth is an authentication configuration skill for the QianWen (Qwen) AI APIs, part of the QianWen-AI/qianwen-ai skill collection. It solves the problem of getting credentials and endpoints set up correctly and diagnosing auth failures: it triggers when setting up the API key, troubleshooting 401/auth errors, when another skill reports missing credentials, or when invoked by name. It configures and verifies authentication using curl for a status check.
The skill documents a credential priority chain (environment variable first, then a .env file in the working directory or repo root) and the relevant environment variables, including DASHSCOPE_API_KEY (with QIANWEN_API_KEY as an alias), an optional base-URL override, and optional custom Aliyun OSS variables for production file uploads that replace the default 48-hour temporary storage. It distinguishes standard keys from Token Plan team keys and points to references for the token plan, custom OSS setup, console sources, and agent compatibility. Its handling of secrets is deliberately conservative and security-conscious: it never outputs any API key or OSS credential in plaintext, reports only status such as set/not-set or valid/invalid, never asks the user to paste their key, and instead helps create a .env file with a placeholder for the user to fill in, adding it to .gitignore and recommending least-privilege RAM users.
Target users are developers integrating QianWen/Qwen text and image models who need to configure authentication and optional production storage. Because it uses standard credential-setup patterns, OS-appropriate environment variables, and masked, non-exfiltrating handling of secrets, its behavior is benign despite touching credentials.
FAQ
Which environment variable holds the API key?
DASHSCOPE_API_KEY is the primary variable, with QIANWEN_API_KEY as an alias that takes priority if both are set. QWEN_BASE_URL can override the endpoint for custom deployments.
Will it print or ask for my API key?
No. It never outputs keys or OSS credentials in plaintext and reports only status. It never asks you to paste your key directly; instead it helps create a .env file with a placeholder for you to fill in.
How are credentials loaded?
By priority: first the environment variable, then a .env file found in the current working directory or repo root (detected via .git or a skills directory). Existing environment variables are not overwritten.
What is the custom OSS configuration for?
Optional production file uploads. Setting QWEN_TMP_OSS_BUCKET (plus region and least-privilege AccessKey credentials) routes uploads to your own Aliyun OSS bucket instead of the default 48-hour temporary storage.
How does it protect OSS credentials and presigned URLs?
OSS keys are treated like the API key: never hardcoded or logged in plaintext, masked in diagnostics, with .env added to .gitignore and RAM users limited to oss:PutObject/oss:GetObject. Presigned URLs are masked because they embed credentials in the query string.
Install qianwen-ops-auth
Quick Setup:
- Copy the skill folder to
.claude/skills/ - Claude will automatically detect and use the skill
Repository
qianwen-ai/qianwen-ai