GLM-V-Prompt-Gen

PassAudited by ClawScan on May 1, 2026.

Overview

This skill is a coherent prompt-generation helper that uses a Zhipu API key and sends user-provided images or video URLs to the Zhipu vision API.

Before installing, make sure you are comfortable providing a Zhipu API key and sending selected images or video URLs to Zhipu for analysis. The provided artifacts do not show hidden persistence, unrelated data access, or credential exfiltration.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

The skill needs access to your Zhipu API key and can make API requests billed or governed by that account.

Why it was flagged

The script uses the configured ZHIPU_API_KEY as a bearer token to authenticate to the Zhipu API, which is expected for this integration but is still sensitive credential use.

Skill content

"Authorization": f"Bearer {api_key}"

Recommendation

Use a revocable API key, monitor usage, and only install if you trust this skill to call the Zhipu API for prompt generation.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Images you choose to analyze, and video URLs you provide, may be sent to Zhipu’s service for processing.

Why it was flagged

The script sends prompt-generation requests, including user-provided image data or video URLs, to an external Zhipu API endpoint.

Skill content

API_BASE_URL = "https://open.bigmodel.cn/api/paas/v4/chat/completions"

Recommendation

Avoid sending private or sensitive visual content unless you are comfortable with Zhipu processing it under its API terms.