ZenStudio CLI

ZenStudio 官方 AI 内容创作 CLI 工具 (zencli)。支持 AI 生图、AI 生视频、 项目管理、资产库、媒资管理、无限画布、文件上传下载等。 Use when user asks to generate images, generate videos, manage projects, up...

Security Scan

The skill mostly matches its stated purpose (a CLI wrapper for ZenStudio) but the runtime instructions reference additional environment/config locations and usage patterns (e.g., storing tokens in ~/.zencli/config.json, passing tokens on the command line, and optional env vars) that are not declared in the skill metadata — those mismatches merit caution.

Purpose & Capability

Name/description, required binary (zencli), and primary credential (ZENSTUDIO_API_KEY) align with a CLI tool that interacts with the ZenStudio platform. Commands shown (generate, upload, asset/material management) are coherent with the described purpose.

Instruction Scope

SKILL.md instructs the agent/user to run zencli commands and to upload/download local files (expected). It also references storing credentials in ~/.zencli/config.json via interactive login and suggests passing tokens on the command line. These are runtime behaviors that could expose or persist credentials, but they are within the functional scope of a CLI upload/generation tool. The skill does not explicitly instruct the agent to read arbitrary system files beyond those needed for normal CLI operation.

Install Mechanism

This is an instruction-only skill (no install spec). SKILL.md recommends installing via `npm install -g zenstudio-cli`, but the skill bundle does not include an automated install step. The lack of an install spec is not itself dangerous, but the evaluator should verify the npm package provenance before installing (official package name, publisher, and checksums).

Credentials

Metadata declares only ZENSTUDIO_API_KEY as required, but SKILL.md also documents optional env vars (ZENSTUDIO_ENDPOINT, ZENCLI_NO_UPDATE_CHECK) and describes credentials being stored under ~/.zencli/config.json. The config file path is not declared in the skill's required config paths. Additionally, the docs show passing a token on the command line (zencli auth login --token <YOUR_API_KEY>), which can expose tokens via process listings. These gaps between declared and referenced environment/config locations reduce transparency and increase risk of accidental credential exposure.

Persistence & Privilege

The skill does not request always:true and is user-invocable; it does not appear to try to modify other skills or system-wide settings. The documented interactive login persists credentials to ~/.zencli/config.json, but that is standard CLI behavior and applies to the CLI, not the skill bundle itself.

What to consider before installing

This skill appears to be a legitimate CLI wrapper for the ZenStudio platform, but check a few things before installing or granting access: - Confirm package provenance before running `npm install -g zenstudio-cli` (official npm author, homepage, and checksums). The skill bundle does not perform the install for you. - Understand where your API key will live: interactive login stores credentials in ~/.zencli/config.json (not declared in metadata) and passing a token on the command line can expose it to other users via process lists. Prefer a secure storage method and limit the key's permissions. - Optional env vars (ZENSTUDIO_ENDPOINT, ZENCLI_NO_UPDATE_CHECK) are referenced in the docs but not declared as required — be aware the CLI may read these if present. - Be careful when using this agent/skill to upload files: uploads will read local file paths you provide, so avoid uploading sensitive files unless you intend to. If you need higher assurance: ask the publisher for the official npm package name, verify the package owner, request that the skill metadata explicitly declare the config path (~/.zencli/config.json) and any optional env vars the CLI may read, and limit the API key scope before use.

ZenStudio CLI (zencli)

AI 内容创作全流程命令行工具，封装 ZenStudio 平台 19+ 核心能力。

安装 & 配置

npm install -g zenstudio-cli

# 配置 API Key（三选一）
zencli auth login                          # 交互式登录（推荐，存入 ~/.zencli/config.json，所有环境可用）
zencli auth login --token <YOUR_API_KEY>   # 命令行传入（同上）
export ZENSTUDIO_API_KEY=<YOUR_API_KEY>    # 环境变量（仅推荐 CI/CD，Agent/子进程可能读不到 shell 配置）

zencli auth status                         # 验证登录状态

API Key 申请：API 管理

命令速查

# === 项目管理 ===
zencli project list [--search "关键词"]    # 列出/搜索项目
zencli project create "项目名"             # 创建项目
zencli project get <id>                    # 项目详情
zencli project update <id> --name "新名称" # 更新项目

# === 上传 / 下载 ===
zencli upload ./file.png -o json           # 上传文件 (COS SDK 直传)
zencli download <asset_id> [-d ./output/]  # 下载素材 (自动处理私有读签名)

# === AI 生图 ===
zencli generate image-models               # 查看可用模型（必须先调用！）
zencli generate image --prompt "描述" --model <model_id> [--aspect-ratio 16:9] [--input-images "url"] --poll

# === AI 生视频 (4 种驱动模式) ===
zencli generate video-models               # 查看可用模型（必须先调用！）
zencli generate video --mode Text --prompt "描述" --model <provider_id> --single-image-url "url" --poll
# 其他模式: FirstLastFrame(--first/last-frame-url)  FrameSequence(--sequence-frames)  SubjectToVideo(--reference-assets)
# 通用选项: --duration <秒> --count 1-4 --enable-sound --poll

# === 媒资库 (asset) — 项目级媒体文件池 ===
zencli asset create --url <cdn_url> --project-id <id> -o json  # 入库（返回带签名 URL）
zencli asset search --project-id <id>      # 搜索
zencli asset get <asset_id>                # 详情

# === 资产库 (material) — 树形管理：人物/道具/场景/网盘 ===
zencli material list role_person           # 人物  |  role_prop 道具  |  role_scene 场景  |  root 网盘文件夹
zencli material add ...                    # 创建素材/文件夹（从媒资库挂载）
zencli material get <material_id>          # 素材详情
zencli role get <role_id>                  # 角色详情（LoRA/提示词/版本）

# === 画布 ===
zencli canvas list                         # 列出画布
zencli canvas create "名称"                # 创建画布
zencli canvas build-draft <canvas_id> --file nodes.json

# === 任务查询 ===
zencli generate task <task_id> [--poll]    # 查询/轮询生成任务状态

# === 通用透传（调用任意 MCP 工具）===
zencli tools list                          # 列出所有工具
zencli tools describe <tool_name>          # 查看参数 schema
zencli tools call <tool_name> --arg key=value [--json-args '{}']

# === URL / 升级 ===
zencli url build "页面名" [--params '{}']  # 构建 ZenStudio 前端链接
zencli url parse <url>                     # 解析 URL
zencli upgrade [--check]                   # 升级 / 仅检查

输出格式: -o json(默认, Agent 推荐) | -o table(人类阅读) | -o text(管道/脚本) | zencli config set output_format <fmt>

关键工作流：上传文件

概念：媒资库(asset) = 项目级文件池；资产库(material) = 树形目录(人物/道具/场景/网盘文件夹)。资产库的素材只能从媒资库挂载。

# 步骤 1: 上传 → CDN URL
zencli upload ./character.png -o json
# 步骤 2: 入媒资库（必须！返回 asset_id + 带签名的 asset_details）
zencli asset create --url <cdn_url> --project-id <project_id> -o json
# 步骤 3（按需）: 挂载到资产库（必传 asset_id + 完整 asset_details）
zencli material add --material-id <asset_id> --material-detail '<asset_details_json>' \
  --parent-id <target_id> --type 2 --project-ids <project_id>

步骤 1→2 强制绑定，上传后必须入媒资库。视频/音频为私有读，只有入库后的 URL 才带签名。

步骤 3 由 Agent 判断："上传文件" → 两步 | "上传到角色/道具/场景/文件夹" → 三步 | "媒资素材添加到资产库" → 仅步骤 3

⚠️ 重要规则

1. 前端链接必须用 zencli url build 生成，严禁自行拼接 URL
2. 模型 ID 必须动态获取：image-models / video-models，严禁猜测或硬编码
3. canvas ≠ project：画布用 canvas，短番项目用 project，不要混用
4. 不确定参数时用 --help 或 tools describe 自行探索

环境变量

• ZENSTUDIO_API_KEY — API Key (Bearer Token)
• ZENSTUDIO_ENDPOINT — API 端点 (默认 https://ai.tvi.v.qq.com/zenstudio/api/mcp)
• ZENCLI_NO_UPDATE_CHECK=1 — 禁用自动版本检查 (CI/CD 推荐)