← 返回 Skills 市场
144
总下载
0
收藏
0
当前安装
2
版本数
在 OpenClaw 中安装
/install zhipu-glm-image
功能描述
智谱 GLM-Image 网页端图片生成与下载。用于：检查 image.z.ai 登录态、必要时自动打开浏览器登录、抓取浏览器 Cookie、通过网页接口生成图片并下载到本地。适用于“用智谱生图”“生成一张图并保存/发送”“检查智谱登录状态”“自动打开智谱登录页”等场景。
安全使用建议
This skill appears to do what it claims, but it captures live browser cookies and saves them unencrypted to disk and requires exposing your browser's remote-debugging port. Only install/run it if you trust the source. Before running: (1) review the scripts (zhipu_api.js) yourself to confirm no unexpected network endpoints or exfiltration, (2) enable remote debugging only on an isolated browser profile or in a disposable VM/container, (3) be aware the tool saves cookies to %USERPROFILE%\.zhipu_image_session.json — delete that file when you're done, (4) run npm install inside the scripts/ directory and inspect the installed dependency (chrome-remote-interface), and (5) if you are not on Windows or cannot/should not expose remote debugging, do not run it. If you want extra assurance, run the tool in a throwaway Windows VM or container and monitor network traffic while using it.
功能分析
Type: OpenClaw Skill
Name: zhipu-glm-image
Version: 1.0.1
The skill automates image generation by extracting browser cookies via the Chrome DevTools Protocol (CDP) on port 18800 and storing them in plaintext in the user's profile directory (%USERPROFILE%\.zhipu_image_session.json). While these actions (found in zhipu_api.js and network_monitor.js) support the stated goal of using a web-based session instead of an API key, the technique of programmatically scraping browser credentials and executing shell commands to open URLs represents a high-risk approach often seen in session-hijacking tools.
能力评估
Purpose & Capability
The name/description match the implementation: the scripts capture browser cookies, check/refresh a login session, call image.z.ai web endpoints using those cookies, and download images. Capturing cookies and opening the site's login page are necessary for the 'web-login-state' approach the skill documents.
Instruction Scope
SKILL.md and the scripts clearly instruct the agent to: use Chrome DevTools Protocol on port 18800 to read cookies, open the site login page if needed, and POST to image.z.ai proxy endpoints. The documentation mentions the remote-debugging dependency and npm install, but does not include step-by-step instructions for securely launching a browser with remote debugging enabled (or for non-Windows platforms). The code is Windows-oriented (uses process.env.USERPROFILE and cmd.exe 'start'), which is stated in places but may not be obvious to all users.
Install Mechanism
There is no automated install spec — the repo includes package.json and asks the user to run npm install in scripts/. The only dependency is chrome-remote-interface from the public npm registry, which is reasonable for using CDP.
Credentials
No environment variables or external credentials are requested, which matches the described cookie-based approach. However, the script reads browser cookies via CDP, filters them by domains (z.ai, bigmodel.cn, chatglm), and writes those cookies unencrypted to a session file in the user's home directory (%USERPROFILE%\.zhipu_image_session.json). Accessing and persisting cookies is sensitive — expected for the stated purpose, but high-risk if you don't trust the code or if other domains are accidentally matched.
Persistence & Privilege
The skill does not request permanent platform privileges (always: false). It does write a local session file and can autonomously open the browser and capture cookies when invoked. If the agent is allowed to invoke skills autonomously, this behavior increases blast radius because the skill can launch the browser and attempt to capture session cookies while running.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install zhipu-glm-image - 安装完成后，直接呼叫该 Skill 的名称或使用
/zhipu-glm-image触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.1
Clean release: removed hard-coded development fallback, added lockfile, clarified session path and install steps, and tightened public docs for safer review.
v1.0.0
Initial release: session-aware image.z.ai login flow, automatic browser login, ready check, and prompt-to-image download helper.
元数据
常见问题
Zhipu GLM Image 是什么？
智谱 GLM-Image 网页端图片生成与下载。用于：检查 image.z.ai 登录态、必要时自动打开浏览器登录、抓取浏览器 Cookie、通过网页接口生成图片并下载到本地。适用于“用智谱生图”“生成一张图并保存/发送”“检查智谱登录状态”“自动打开智谱登录页”等场景。 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 144 次。
如何安装 Zhipu GLM Image？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install zhipu-glm-image」即可一键安装，无需额外配置。
Zhipu GLM Image 是免费的吗？
是的，Zhipu GLM Image 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
Zhipu GLM Image 支持哪些平台？
Zhipu GLM Image 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Zhipu GLM Image？
由 huangm199（@huangm199）开发并维护，当前版本 v1.0.1。
推荐 Skills