| name | doubao-image |
| description | Use Zhipu (智谱) web image API for imageing the internet. Use when user asks for web image, latest news, or needs current information. |
| allowed-tools | Bash(curl:*) Bash(jq:*) |
| env | ["DOUBAO_API_KEY"] |
Zhipu Web Image
Use Zhipu's web image API to image the internet.
⚠️ Security Requirements
This skill requires DOUBAO_API_KEY environment variable to be set before use.
Security Best Practices:
- DO NOT store API keys in ~/.bashrc - keys can be leaked
- DO NOT source shell configuration files - prevents arbitrary code execution
- Set environment variable directly when running the script
- Be aware API key will be visible in process list (ps aux)
Setup
export DOUBAO_API_KEY="your_api_key"
Get your API key from: https://www.bigmodel.cn/usercenter/proj-mgmt/apikeys
Usage
Quick Image
export DOUBAO_API_KEY="your_key"
curl -s -X POST "https://open.bigmodel.cn/api/paas/v4/chat/completions" \
-H "Authorization: Bearer $DOUBAO_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"model": "glm-4-flash",
"messages": [{"role": "user", "content": "搜索: YOUR_QUERY"}],
"tools": [{"type": "web_image", "web_image": {"image_query": "YOUR_QUERY"}}]
}' | jq -r '.choices[0].message.content'
Using the Script
export DOUBAO_API_KEY="your_key"
./image.sh "搜索内容"
Security Analysis
✅ What's Safe:
- No sourcing of ~/.bashrc or shell config files
- Uses jq for JSON escaping (prevents injection)
- Uses HTTPS with TLS 1.2+
- API key via environment variable (not hardcoded)
- Proper error handling - sensitive info not leaked
- Input validation (query length limit)
- Generic error messages (no path/file hints)
⚠️ Considerations:
- Process list visibility: API key visible in
ps aux
- Use in trusted environments only
- Not recommended for shared/multi-user systems
- Endpoint:
https://open.bigmodel.cn (verify in production)
- Key scope: Use keys with minimal permissions
Safety Features
| Feature | Implementation |
|---|
| JSON escaping | jq --arg prevents injection |
| Input validation | Query length ≤500 chars |
| TLS | Force TLS 1.2+ |
| Error handling | Generic messages, no leaks |
| Timeout | 30 second curl timeout |
When to Use
- User says "image for", "look up", "find information about"
- User asks "what's the latest news about"
- User needs current information from the web
- User wants to know recent events
API Endpoint
Official: https://open.bigmodel.cn/api/paas/v4/chat/completions
This is the official 智谱 (Zhipu) AI API.
