Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Z.AI Coding Plan Setup

v1.0.0

Configure OpenClaw to use Z.AI GLM Coding Plan models with optimal settings, region selection, API key setup, model choice, and MCP tools for enhanced coding...

0· 111·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for nelmaz/zai-coding.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Z.AI Coding Plan Setup" (nelmaz/zai-coding) from ClawHub.
Skill page: https://clawhub.ai/nelmaz/zai-coding
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install zai-coding

ClawHub CLI

Package manager switcher

npx clawhub@latest install zai-coding
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's name and description (configure OpenClaw to use Z.AI GLM models) match the SKILL.md content: it tells you how to set the endpoint, model, and config. However the registry metadata declares no required environment variables or primary credential while the instructions explicitly require a ZAI_API_KEY and endpoints — a clear metadata/instruction mismatch.
!
Instruction Scope
The SKILL.md tells the agent/user to edit ~/.openclaw/openclaw.json, set ZAI_API_KEY, enable tooling (filesystem, shell, browser), change config values (context tokens), restart the gateway, and 'install Z.AI MCP Tools'. Editing the user OpenClaw config and enabling shell/filesystem tools is within the functional scope of creating a coding agent but also grants broad local access. The guide does not show how MCP tools are installed and gives no verification steps for downloaded components.
Install Mechanism
This is instruction-only with no install spec or code files, so nothing will be automatically downloaded or written by the skill itself. That lowers installation risk. However the doc references installing MCP tools but provides no install commands or verified source URLs.
!
Credentials
The instructions require a ZAI_API_KEY environment variable and suggest endpoints for international/China regions, but the skill metadata declares no required env vars or primary credential. Requiring an API key is proportionate to the stated purpose, but the omission from metadata is an inconsistency that prevents automated gate checks and user warnings. Also enabling tools like 'filesystem' and 'shell' effectively escalates what the agent can access relative to simply using a model API key.
Persistence & Privilege
The skill does not request always:true and is user-invocable only. It instructs editing the user's OpenClaw config file (~/.openclaw/openclaw.json) and restarting the gateway, which is normal for configuring a runtime integration and is limited to the user's OpenClaw instance rather than system-wide privilege escalation.
What to consider before installing
This skill's instructions look like a legitimate guide to configure OpenClaw with Z.AI models, but several things don't add up and you should be cautious: (1) The guide requires a ZAI_API_KEY but the skill metadata doesn't declare any required credentials — ask the publisher to declare the env var so automated checks can warn you. (2) The instructions ask you to enable tools like filesystem and shell for the agent; those grant the agent broad local access — only enable them if you trust the model provider and the agent's behavior. (3) The SKILL.md mentions installing MCP tools but includes no verified install commands or URLs; before running any install steps, verify official installation instructions from Z.AI or bigmodel.cn and prefer official release pages. (4) Back up ~/.openclaw/openclaw.json before making edits and validate configs with openclaw config validate. If you do not trust the skill source or cannot verify the endpoints and MCP tools, do not apply the changes. If you want to proceed safely, request the author to (a) add ZAI_API_KEY to the skill's declared requirements, (b) provide explicit, verifiable install steps or links for MCP tools, and (c) document why shell/filesystem/browser tools are needed and how to limit their scope.

Like a lobster shell, security has layers — review code before you run it.

latestvk973kfa00whq5d26ebhebkfpan83b2jh
111downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

Z.AI Coding Plan Setup

Overview

Configure OpenClaw to use Z.AI GLM Coding Plan models for optimal coding performance. Z.AI provides multiple GLM models optimized for development tasks with varying context windows and performance characteristics.

Prerequisites

Before configuring Z.AI Coding Plan:

  1. OpenClaw installed - Verify with openclaw gateway status
  2. Z.AI API Key - Available from https://z.ai/subscribe (international) or https://bigmodel.cn (China)
  3. Docker environment - API key available as ZAI_API_KEY environment variable

Available Models

Model IDContextBest For
glm-5205K tokensLatest flagship, best overall performance
glm-5-turbo200K tokensFast responses, quick iterations
glm-4.7205K tokensBalanced performance, strong reasoning
glm-4.7-flash200K tokensQuick iterations, prototyping
glm-4.7-flashx200K tokensOptimized speed
glm-4.6205K tokensStable, excellent coding
glm-4.6v128K tokensVision + coding (UI work)
glm-4.5131K tokensEfficient coding
glm-4.5-air131K tokensLightweight operations
glm-4.5-flash131K tokensFast coding, cost-effective

Configuration Steps

Step 1: Verify OpenClaw Status

openclaw gateway status

Step 2: Choose Configuration Method

Option A: Interactive Setup (Recommended)

International users:

openclaw onboard --auth-choice zai-coding-global

China region users:

openclaw onboard --auth-choice zai-coding-cn

This prompts for the API key and configures everything automatically.

Option B: Manual Configuration

Edit ~/.openclaw/openclaw.json:

{
  "env": {
    "ZAI_API_KEY": "sk-your-api-key-here"
  },
  "agents": {
    "defaults": {
      "model": {
        "primary": "zai/glm-5"
      }
    }
  }
}

Important: Model format is zai/<model-name>.

Step 3: Configure Coding-Specific Settings

For optimal coding performance:

# Enable tool streaming (better for coding workflows)
openclaw config set agents.defaults.models."zai/glm-5".params.tool_stream true --json

# Set higher context for complex projects (optional)
openclaw config set agents.defaults.maxContextTokens 150000

Step 4: Optional - Create Coding-Focused Agent

For dedicated coding agents:

openclaw agents create coding-assistant

Configure in ~/.openclaw/openclaw.json:

{
  "agents": {
    "coding-assistant": {
      "model": {
        "primary": "zai/glm-5"
      },
      "systemPrompt": "You are an expert software developer. Focus on writing clean, efficient, and well-documented code. Always explain your reasoning and provide best practices.",
      "tools": ["filesystem", "shell", "browser"]
    }
  }
}

Step 5: Restart and Verify

# Validate configuration
openclaw config validate

# Restart gateway
openclaw gateway restart

# Check status
openclaw status

Step 6: Test Configuration

Test with a simple coding task:

openclaw chat "Write a Python function to calculate the fibonacci sequence"

Model Selection Guide

Use the right model based on your needs:

  • General codingzai/glm-5 - Best overall performance
  • Quick prototypingzai/glm-5-turbo - Fast responses
  • Complex refactoringzai/glm-4.7 - Strong reasoning
  • Code reviewzai/glm-4.6 - Stable, thorough
  • UI/Frontend workzai/glm-4.6v - Vision capabilities
  • Simple scriptszai/glm-4.5-flash - Cost-effective

Region Configuration

  • International: zai-coding-global endpoint → https://api.z.ai/api/coding/paas/v4
  • China: zai-coding-cn endpoint → https://api.bigmodel.cn/api/coding/paas/v4

Troubleshooting

Authentication Error (1001)

API key missing or invalid:

openclaw config get env.ZAI_API_KEY

Model Not Found

Ensure correct endpoint:

# International
https://api.z.ai/api/coding/paas/v4

# China
https://api.bigmodel.cn/api/coding/paas/v4

Rate Limiting

GLM Coding Plan has usage limits based on subscription tier:

  • Lite: 120 prompts per 5-hour cycle
  • Pro: 600 prompts per 5-hour cycle
  • Max: Higher limits

Gateway Won't Start

# Check logs
openclaw gateway logs

# Validate config
openclaw config validate

# Reset if needed
openclaw config reset

Switching Models

To change the default model:

# Set new model
openclaw config set agents.defaults.model.primary "zai/glm-4.7"

# Restart to apply
openclaw gateway restart

Integration with Channels

This configuration works with all OpenClaw channels:

  • Feishu: Coding model used for all coding requests
  • DingTalk: Same model configuration
  • WeCom: Compatible with coding workflows
  • CLI: Direct access via openclaw chat

Useful Commands

CommandDescription
openclaw config get agents.defaults.modelCheck current model
openclaw config set agents.defaults.model.primary "zai/glm-5"Change model
openclaw gateway restartApply changes
openclaw statusVerify configuration

Z.AI MCP Tools Configuration

GLM Coding Plan includes powerful MCP tools for web access and code research. These tools are exclusive to Coding Plan subscribers.

Available MCP Tools

ToolDescriptionUse Case
Web SearchSearch the web for real-time informationFinding documentation, news, tutorials
Web ReaderExtract full content from any webpageReading articles, docs, extracting data
ZreadAccess GitHub repositories documentation & codeUnderstanding open-source projects

MCP Quotas by Plan

PlanWeb Searches + Readers + Zread
Lite100 total
Pro1,000 total
Max4,000 total

Step 7: Install Z.AI MCP Tools

After configuring the model, add the MCP tools to enhance your coding agent.

Tool 1: Web Search (web-search-prime)

Provides real-time web search capabilities.

One-click install (OpenClaw):

openclaw mcp add web-search-prime --type http --url "https://api.z.ai/api/mcp/web_search_prime/mcp" --header "Authorization: Bearer YOUR_API_KEY"

Manual configuration - Add to ~/.openclaw/openclaw.json:

{
 "mcpServers": {
 "web-search-prime": {
 "type": "http",
 "url": "https://api.z.ai/api/mcp/web_search_prime/mcp",
 "headers": {
 "Authorization": "Bearer YOUR_API_KEY"
 }
 }
 }
}

Available tool: webSearchPrime - Search web information with titles, URLs, summaries


Tool 2: Web Reader (web-reader)

Extracts complete content from any webpage.

One-click install (OpenClaw):

openclaw mcp add web-reader --type http --url "https://api.z.ai/api/mcp/web_reader/mcp" --header "Authorization: Bearer YOUR_API_KEY"

Manual configuration - Add to ~/.openclaw/openclaw.json:

{
 "mcpServers": {
 "web-reader": {
 "type": "http",
 "url": "https://api.z.ai/api/mcp/web_reader/mcp",
 "headers": {
 "Authorization": "Bearer YOUR_API_KEY"
 }
 }
 }
}

Available tool: webReader - Fetch page title, main content, metadata, links


Tool 3: Zread (zread)

Access GitHub repositories for documentation and code analysis.

One-click install (OpenClaw):

openclaw mcp add zread --type http --url "https://api.z.ai/api/mcp/zread/mcp" --header "Authorization: Bearer YOUR_API_KEY"

Manual configuration - Add to ~/.openclaw/openclaw.json:

{
 "mcpServers": {
 "zread": {
 "type": "http",
 "url": "https://api.z.ai/api/mcp/zread/mcp",
 "headers": {
 "Authorization": "Bearer YOUR_API_KEY"
 }
 }
 }
}

Available tools:

ToolDescription
search_docSearch documentation in GitHub repositories
get_repo_structureGet directory structure and file list
read_fileRead complete code content of files

Complete MCP Configuration Example

Here's a complete ~/.openclaw/openclaw.json with all three MCP tools:

{
 "env": {
 "ZAI_API_KEY": "sk-your-api-key-here"
 },
 "agents": {
 "defaults": {
 "model": {
 "primary": "zai/glm-5"
 }
 }
 },
 "mcpServers": {
 "web-search-prime": {
 "type": "http",
 "url": "https://api.z.ai/api/mcp/web_search_prime/mcp",
 "headers": {
 "Authorization": "Bearer sk-your-api-key-here"
 }
 },
 "web-reader": {
 "type": "http",
 "url": "https://api.z.ai/api/mcp/web_reader/mcp",
 "headers": {
 "Authorization": "Bearer sk-your-api-key-here"
 }
 },
 "zread": {
 "type": "http",
 "url": "https://api.z.ai/api/mcp/zread/mcp",
 "headers": {
 "Authorization": "Bearer sk-your-api-key-here"
 }
 }
 }
}

Step 8: Verify MCP Tools Installation

After adding the MCP tools, restart and verify:

# Restart gateway to load MCP servers
openclaw gateway restart

# Check MCP status
openclaw mcp list

# Verify tools are available
openclaw status

Step 9: Test the MCP Tools

Test each tool to ensure proper configuration:

Test Web Search:

openclaw chat "Search for the latest Python 3.12 features"

Test Web Reader:

openclaw chat "Read and summarize the content from https://docs.python.org/3/whatsnew/3.12.html"

Test Zread:

openclaw chat "Explain the structure of the fastapi/fastapi repository on GitHub"

MCP Tools Troubleshooting

Invalid API Key

Error: Invalid access token

Solutions:

  1. Verify API key is correctly copied (no extra spaces)
  2. Check API key is activated at https://z.ai/manage-apikey/apikey-list
  3. Ensure sufficient balance on your account
  4. Verify Authorization: Bearer format is correct

Connection Timeout

Solutions:

  1. Check network connection
  2. Verify firewall allows HTTPS connections
  3. Increase client timeout settings
  4. Try again later (server may be busy)

Repository Access Failed (Zread)

Solutions:

  1. Confirm repository exists and is public
  2. Check repository name format: owner/repo
  3. Visit https://zread.ai to verify repository is indexed

Quota Exceeded

Error: Rate limit exceeded

Solution: Wait for the next 5-hour cycle or upgrade your plan


MCP Tools Use Cases

ScenarioTools to UseExample Prompt
Research a libraryZread + Web Search"Research the React hooks API and find best practices"
Debug an issueWeb Search + Web Reader"Search for solutions to 'Python asyncio CancelledError'"
Learn a new frameworkZread"Explain the architecture of the Next.js repository"
Stay updatedWeb Search"What are the latest updates in TypeScript 5.4?"
Read documentationWeb Reader"Read the FastAPI authentication documentation"

References

Comments

Loading comments...