vwu.ai kling Models

Access and use seven kling language models on vwu.ai platform with OpenAI-compatible chat completions via API key authentication.

This skill appears to implement the claimed vwu.ai model calls, but there are a few red flags you should address before using it with real credentials: (1) The registry metadata does not declare the required VWU_API_KEY or the needed CLI tools (curl, jq, zsh) — assume you must provide these. (2) The script allows VWU_BASE_URL to be overridden by an environment variable but SKILL.md doesn't mention that; consider hardcoding or verifying VWU_BASE_URL is set to https://vwu.ai to avoid accidentally sending your key to another endpoint. (3) The script reveals the first 8 characters of your API key in error messages; avoid using your main/long-lived key—use an ephemeral or limited-scope key if possible. (4) Review the vwu-chat.sh file yourself (or run it in an isolated environment) before exporting any secrets. If you plan to install broadly, ask the author to update registry metadata to declare VWU_API_KEY and required binaries and to document/lock the base URL.

Type: OpenClaw Skill Name: vwu-kling Version: 1.0.0 The skill bundle contains a shell injection vulnerability in `vwu-chat.sh` where the user-provided prompt is expanded within a double-quoted string passed to `curl`. This allows for arbitrary command execution if a crafted prompt (e.g., containing backticks or subshells) is provided to the script. While the code logic aligns with the stated purpose of interacting with the vwu.ai API, the lack of input sanitization is a significant security risk, although no clear evidence of intentional malice was identified.