ANOLISA is a server-side operating layer for AI agent workloads that provides terminal access, token-saving tool-output compression, runtime controls, security, observability, skills, memory, and sandbox management. It is for running and supervising agents from a Linux terminal while retaining an existing shell, agent framework, and sandbox. The catalogue add-ons are components of its agent operating environment and workflows.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add alibaba/anolisa --skill install-qwenpawgit clone --depth 1 https://github.com/alibaba/anolisaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/alibaba/anolisa/install-qwenpaw)<a href="https://agentmods.dev/skills/alibaba/anolisa/install-qwenpaw"><img src="https://agentmods.dev/badge/skills/alibaba/anolisa/install-qwenpaw/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/alibaba/anolisa/install-qwenpaw"><img src="https://agentmods.dev/badge/skills/alibaba/anolisa/install-qwenpaw.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00088 | $0.02422 |
| Opus 5 | $0.00044 | $0.01211 |
| Sonnet 5 | $0.00018 | $0.00484 |
| Haiku 4.5 | $0.00009 | $0.00242 |
Grade D, and why
install-qwenpaw scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
chmod 700 ~/.qwenpaw.secret ~/.qwenpaw.secret/providers ~/.qwenpaw.secret/providers/builtin ~/.qwenpaw.secret/providers/custom Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
# curl -LsSf https://astral.sh/uv/install.sh | sh Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
# curl -LsSf https://astral.sh/uv/install.sh | sh How it starts
The opening of the file, as written. The whole thing — 274 lines — stays where its author put it; the contents beside it link to each section on GitHub.
QwenPaw Linux 服务器安装部署
前置信息收集
开始前必须向用户获取以下信息,缺一不可:
- 百炼 API Key — 格式以
sk-开头,从 https://bailian.console.aliyun.com/ 获取 - 钉钉 Client ID — 即 AppKey,从钉钉开发者后台获取
- 钉钉 Client Secret — 即 AppSecret,从钉钉开发者后台获取
- 模型名称(可选)— 默认
qwen3-max,可选qwen3-235b-a22b-thinking-2507、deepseek-v3.2等
一键部署(推荐)
本 skill 提供了一键部署脚本 scripts/setup.sh,收集到用户信息后直接执行:
bash scripts/setup.sh <百炼API_KEY> <钉钉CLIENT_ID> <钉钉CLIENT_SECRET> [模型名称]
示例:
bash scripts/setup.sh sk-76f003xxx dingxxxxx your_secret
bash scripts/setup.sh sk-76f003xxx dingxxxxx your_secret qwen3-235b-a22b-thinking-2507
脚本会自动完成:检查 uv → 安装 QwenPaw → 创建目录 → 写入配置(替换占位符)→ 验证文件 → 后台启动服务。
执行前需要先将本 skill 目录上传到服务器,或通过工具将 scripts/setup.sh 和 reference/ 目录写入服务器。
手动分步部署
如果脚本不可用,按以下步骤手动操作。
步骤 1: 检查并安装 uv
QwenPaw 依赖 uv 作为 Python 包管理器。优先通过阿里云镜像安装,失败时用官方脚本兜底:
if command -v uv &>/dev/null; then
echo "uv 已安装: $(uv --version)"
else
# 方式 1: pip + 阿里云镜像(推荐)
pip install uv -i https://mirrors.aliyun.com/pypi/simple/
# 方式 2: 官方安装脚本(pip 不可用时)
# curl -LsSf https://astral.sh/uv/install.sh | sh
fi
步骤 2: 安装 QwenPaw
# 方式 1: 阿里云镜像(推荐)
uv pip install qwenpaw --index-url https://mirrors.aliyun.com/pypi/simple/
# 方式 2: 官方安装脚本(镜像不可用时)
# curl -fsSL https://qwenpaw.agentscope.io/install.sh | bash
# source ~/.bashrc
验证:
qwenpaw --version
找不到命令时手动加 PATH:
export PATH="$HOME/.qwenpaw/bin:$PATH"
echo 'export PATH="$HOME/.qwenpaw/bin:$PATH"' >> ~/.bashrc
source ~/.bashrc
步骤 3: 创建目录结构
mkdir -p ~/.qwenpaw/media
mkdir -p ~/.qwenpaw/active_skills
mkdir -p ~/.qwenpaw/customized_skills
mkdir -p ~/.qwenpaw.secret/providers/builtin
mkdir -p ~/.qwenpaw.secret/providers/custom
chmod 700 ~/.qwenpaw.secret ~/.qwenpaw.secret/providers ~/.qwenpaw.secret/providers/builtin ~/.qwenpaw.secret/providers/custom
步骤 4: 写入配置文件
读取 reference/ 下的模板文件,替换占位符后写入目标路径。
3a: config.json(含钉钉频道配置)
读取 reference/config.json.example,替换后写入 ~/.qwenpaw/config.json:
What ships with it
10 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 274 lines · 88 tokens per session scan D 8ad66d212971
install-qwenpaw is a skill published in the GitHub repository alibaba/anolisa (585 stars, last pushed today), licensed Apache-2.0. It adds 88 tokens to every session and 2,422 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it D with 3 findings (asks for root, downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
convex-domains
Point a domain you already own at your Convex app (DNS records, custom-domain attach, auth-origin rebind).
convex-ship
Publish the current Convex app to a live .convex.app URL (deploy backend + upload web build).
ov-server-operate
Operate and maintain OpenViking server - configure, install, start, stop, and cleanup the server. Use when need to setup or manage OpenViking service deployment.
beevibe-team-mesh-negotiation
Multi-round negotiation protocol — covers both initiator and peer roles. Use when about to call negotiate(), when receiving a intent block as a peer, or when receiving an 'escalated' sentinel from a blocked respondnegotiate. Covers proposal crafting, counter-strategy, deadlock detection, when to accept early…
beevibe-verify-pr
CI verification before marking a PR-bearing task done. Use BEFORE calling mcpbeevibeupdateprogress(done) on any session whose deliverable is a pull request — including the first dispatch (you opened the PR with gh pr create) and any revision dispatch (you pushed new commits to an existing PR). Watches the PR's…
beevibe-pre-task-setup
Cold-start git workspace setup for a fresh beevibe task. Use at the start of a session whose intent has a block but NO or block — i.e. the first dispatch of this task. Checks for an existing repo clone, pulls the base branch if present (clone if missing), prunes any per-task worktrees from earlier tasks whose work has…