zhipu-image

智谱 GLM-Image 网页端图片生成与下载。用于：检查 image.z.ai 登录态、必要时自动打开浏览器登录、抓取浏览器 Cookie、通过网页接口生成图片并下载到本地。适用于“用智谱生图”“生成一张图并保存/发送”“检查智谱登录状态”“自动打开智谱登录页”等场景。

This skill will capture your browser session cookies for image.z.ai (it uses Chrome DevTools Protocol on port 18800) and save them as a plaintext JSON session file in your user home directory. Those cookies can grant access to your account, so only use this on a machine you trust. Note also: the code is Windows-oriented (uses USERPROFILE and start with cmd.exe) despite no OS restriction in metadata; if you're on macOS/Linux it likely won't work without modification. There's an odd fallback require path (an absolute path to another user's workspace) in zhipu_api.js — likely leftover developer code; it won't necessarily be malicious but is a red flag you may want to inspect. Before installing: review the JS source yourself, run npm install in an isolated environment (or a VM/container), ensure you understand and are comfortable with storing cookies in ~/.zhipu_image_session.json (or USERPROFILE), and consider manually exporting cookies rather than auto-capture if you have security concerns. After use, delete the session file if you no longer want stored credentials.

Type: OpenClaw Skill Name: zhipu-image Version: 2.0.0 The skill automates image generation by extracting session cookies from a browser using the Chrome Remote Debugging Protocol (CDP) on port 18800, which is a high-risk method for session management. A notable indicator of poor practice or environment-specific targeting is found in `scripts/zhipu_api.js`, which contains a hardcoded absolute path to a specific user's directory (`C:\Users\huang\...`) for loading dependencies. While the data flow appears limited to the target service (image.z.ai), the combination of cookie scraping and hardcoded local paths makes this bundle suspicious.