Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add darellchua2/opencode-config-template --skill zai-video-skillgit clone --depth 1 https://github.com/darellchua2/opencode-config-templateWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/darellchua2/opencode-config-template/zai-video-skill)<a href="https://agentmods.dev/skills/darellchua2/opencode-config-template/zai-video-skill"><img src="https://agentmods.dev/badge/skills/darellchua2/opencode-config-template/zai-video-skill.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00058 | $0.01679 |
| Opus 5 | $0.00029 | $0.00839 |
| Sonnet 5 | $0.00012 | $0.00336 |
| Haiku 4.5 | $0.00006 | $0.00168 |
Grade C, and why
zai-video-skill scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
URL=$(curl -sS --max-time 30 "$BASE/async-result/$TASK_ID" -H "Authorization: Bearer $KEY" | python3 -c ' Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
RESP=$(curl -sS --max-time 60 -X POST "$BASE/videos/generations" \ How it starts
The opening of the file, as written. The whole thing — 132 lines — stays where its author put it; the contents beside it link to each section on GitHub.
What I do
I provide the exact recipe for an agent to generate a video via the Z.AI
CogVideoX-3 API and save it to a local file. Generation is asynchronous:
POST /videos/generations returns a task id, and the finished MP4 URL only appears
after polling GET /async-result/{id}. OpenCode's provider layer is chat-only, so this
endpoint is reachable only through direct HTTP calls.
Why a skill (not a provider)
- OpenCode providers speak chat completions — they cannot hit
/videos/generationsor return binary files. - Video tasks take minutes; the agent must submit, then poll in the background (PTY pattern below) instead of blocking the session in a synchronous loop.
- The result is a URL — a file must be downloaded and its path returned.
Prerequisite — API key resolution
KEY="${ZAI_API_KEY:-$(jq -r '.["zai"].key // .["zai-coding-plan"].key // empty' \
~/.local/share/opencode/auth.json 2>/dev/null)}"
[ -z "$KEY" ] && { echo "ZAI_API_KEY not found — set it (export ZAI_API_KEY) or run \`opencode auth login\` (Z.AI)."; exit 1; }
If neither source has the key, stop and report — do not proceed.
Recipe
1. Submit the task
# --- options ---
PROMPT="A slow dolly shot through a neon-lit city street at night, rain on asphalt" # REQUIRED
IMAGE="" # optional first-frame image URL or base64 (i2v)
DURATION="${DURATION:-5}" # 5 | 10 (seconds)
FPS="${FPS:-30}" # 30 | 60
SIZE="${SIZE:-1920x1080}" # up to 4K; e.g. 1280x720, 1920x1080, 3840x2160
WITH_AUDIO="${WITH_AUDIO:-false}" # true adds generated audio track
BASE="${ZAI_MEDIA_ENDPOINT:-https://api.z.ai/api/paas/v4}" # pay-as-you-go ONLY (not on the coding plan)
BODY=$(python3 -c 'import json,sys
b={"model":"cogvideox-3","prompt":sys.argv[1],"duration":int(sys.argv[2]),"fps":int(sys.argv[3]),"size":sys.argv[4],"with_audio":sys.argv[5]=="true"}
if sys.argv[6]: b["image_url"]=sys.argv[6]
print(json.dumps(b))' "$PROMPT" "$DURATION" "$FPS" "$SIZE" "$WITH_AUDIO" "$IMAGE")
RESP=$(curl -sS --max-time 60 -X POST "$BASE/videos/generations" \
-H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d "$BODY")
TASK_ID=$(printf '%s' "$RESP" | python3 -c '
import sys, json
d = json.load(sys.stdin)
if d.get("error"):
sys.stderr.write("API error: " + json.dumps(d["error"]) + "\n"); sys.exit(1)
print(d.get("id",""))') || { echo "Submit failed. Response: $RESP"; exit 1; }
[ -z "$TASK_ID" ] && { echo "No task id in response: $RESP"; exit 1; }
echo "SUBMITTED: $TASK_ID (billable ~\$0.20/video once it runs)"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 132 lines · 58 tokens per session scan C 94318c594c99
zai-video-skill is a skill published in the GitHub repository darellchua2/opencode-config-template (6 stars, last pushed yesterday), licensed Apache-2.0. It adds 58 tokens to every session and 1,679 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
minimax-cli
Nested swiss-knife reference for the MiniMax mmx CLI and the canonical MiniMax CLI procedure shipped with the TUI: install mmx-cli, discover the correct TUI-managed MiniMax preset/key slot without leaking secrets, match mainland vs international regions, and route image/video/music/TTS generation or one-shot shell…
media-generation
Generate and edit images, create videos, synthesize speech, transcribe and translate audio using multiple AI providers (OpenAI, Google, ElevenLabs, Deepgram, Fal, Luma, Replicate, Stability, Runway, OpenRouter, Edge TTS). Use when the user asks to create media assets, generate pictures, make videos, produce…
kling-video
Generate AI videos using Kling video generation models. Use when you need to: (1) create videos from text prompts, (2) animate images into videos, (3) transform existing videos with AI, or (4) create AI avatar videos with speech.
webgl-holographic-foil
A self-contained WebGL2 hero: thin-film interference over a crushed-foil surface whose palette shifts with the viewing angle; move the cursor to tilt the film.
general-video
Author or edit a custom HyperFrames composition when no specialized workflow fits, or when BRIEF.md sets flow: companion. Use for longer or multi-scene pieces, brand and sizzle reels, montages, static loops, static title cards, footage remixes, and freeform builds. Use motion-graphics instead for a short unnarrated…
html-ppt-hermes-cyber-terminal
OpenDesign + BYOK: choosing and wiring your own model, hands-on — cost, quality, and the routing decision. Built as a decision-grade AI literacy deck for engineers, IT, applied-AI teams.