智谱调用MCP，需要开通coding plan

智谱 AI 视觉、搜索与生图工具集 — 图像分析、OCR 文字提取、错误截图诊断、UI 截图转代码、技术图表解读、数据可视化分析、视频理解、UI 差异对比、联网搜索、网页读取、GitHub 仓库检索、AI 生图（CogView）、AI 生视频（CogVideoX）。共 4 个 MCP Server、13 个工具...

This skill will read your OpenClaw agent's auth-profiles.json (~/.openclaw/agents/main/agent/auth-profiles.json) to extract the zai API key and then use npx at runtime to fetch and run npm packages (mcporter and @z_ai/mcp-server). Those behaviors are necessary for contacting open.bigmodel.cn but carry risk: npx executes remote code and the script accesses a local secrets file. Before installing: 1) only proceed if you trust open.bigmodel.cn and the @z_ai/mcp-server/mcporter packages; 2) inspect the referenced npm packages' source and versions; 3) consider creating a dedicated, limited-scope API key/profile (not your main agent credentials) and put it at the expected profile path if you must use the skill; 4) if you prefer not to allow runtime npm installs or local secret access, avoid installing this skill or run it in an isolated environment. Additional information that would change this assessment: a declared required env/primary credential entry, pinned package versions or a vetted install spec (instead of unpinned npx usage), or an explicit statement that the skill only reads the single zai key and no other secrets.

Type: OpenClaw Skill Name: zhipu-coding-plan-mcp Version: 1.3.0 The skill bundle provides a legitimate integration for Zhipu AI services, including vision, search, and media generation. It uses a wrapper script (scripts/zai-mcp.js) to automate the retrieval of API keys from the standard OpenClaw configuration path (~/.openclaw/agents/main/agent/auth-profiles.json) and passes them to official Zhipu AI MCP endpoints (open.bigmodel.cn). The code logic is transparent, follows the stated purpose, and does not exhibit signs of malicious exfiltration or unauthorized execution.