doubao-image

name	doubao-image
description	Use Zhipu (智谱) web image API for imageing the internet. Use when user asks for web image, latest news, or needs current information.
allowed-tools	Bash(curl:*) Bash(jq:*)
env	["DOUBAO_API_KEY"]

Zhipu Web Image

Use Zhipu's web image API to image the internet.

⚠️ Security Requirements

This skill requires DOUBAO_API_KEY environment variable to be set before use.

Security Best Practices:

1. DO NOT store API keys in ~/.bashrc - keys can be leaked
2. DO NOT source shell configuration files - prevents arbitrary code execution
3. Set environment variable directly when running the script
4. Be aware API key will be visible in process list (ps aux)

Setup

# Set API key as environment variable
export DOUBAO_API_KEY="your_api_key"

Get your API key from: https://www.bigmodel.cn/usercenter/proj-mgmt/apikeys

Usage

Quick Image

export DOUBAO_API_KEY="your_key"

curl -s -X POST "https://open.bigmodel.cn/api/paas/v4/chat/completions" \
  -H "Authorization: Bearer $DOUBAO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "glm-4-flash",
    "messages": [{"role": "user", "content": "搜索: YOUR_QUERY"}],
    "tools": [{"type": "web_image", "web_image": {"image_query": "YOUR_QUERY"}}]
  }' | jq -r '.choices[0].message.content'

Using the Script

export DOUBAO_API_KEY="your_key"
./image.sh "搜索内容"

Security Analysis

✅ What's Safe:

• No sourcing of ~/.bashrc or shell config files
• Uses jq for JSON escaping (prevents injection)
• Uses HTTPS with TLS 1.2+
• API key via environment variable (not hardcoded)
• Proper error handling - sensitive info not leaked
• Input validation (query length limit)
• Generic error messages (no path/file hints)

⚠️ Considerations:

• Process list visibility: API key visible in ps aux
  • Use in trusted environments only
  • Not recommended for shared/multi-user systems
• Endpoint: https://open.bigmodel.cn (verify in production)
• Key scope: Use keys with minimal permissions

Safety Features

Feature	Implementation
JSON escaping	jq --arg prevents injection
Input validation	Query length ≤500 chars
TLS	Force TLS 1.2+
Error handling	Generic messages, no leaks
Timeout	30 second curl timeout

When to Use

• User says "image for", "look up", "find information about"
• User asks "what's the latest news about"
• User needs current information from the web
• User wants to know recent events

API Endpoint

Official: https://open.bigmodel.cn/api/paas/v4/chat/completions

This is the official 智谱 (Zhipu) AI API.