vwu.ai Sihai Models

Call and interact with vwu.ai Sihai models including sihai-i2v-31, sihai-image-27, sihai-t2v-29, and sihai-tts-25 with OpenAI-compatible API.

This skill appears to implement what it claims (calling vwu.ai models) but has a few issues to consider before installing: - The package metadata claims no required env vars, but SKILL.md and the script require VWU_API_KEY (and may use VWU_BASE_URL). Expect to provide an API key. - The bundled script prints the first 8 characters of your API key on certain API errors — while partial, that is an information leak you may prefer to avoid. Consider editing the script to remove that line before use. - The script uses curl and jq and has a zsh shebang; ensure those binaries are present and that running a zsh script is acceptable in your environment. - The skill's source and homepage are unknown; if you don't trust the owner, verify the script and confirm the vwu.ai endpoint before providing credentials. Recommended actions: ask the publisher to update metadata to declare VWU_API_KEY as a required env var, remove printing of API key fragments, and document binary requirements (curl, jq). If you accept those caveats and trust vwu.ai, the skill is functionally appropriate; otherwise do not install or run without reviewing/modifying the script.

Type: OpenClaw Skill Name: vwu-sihai Version: 1.0.0 The skill bundle contains a shell script `vwu-chat.sh` that is vulnerable to command injection. The script expands the `$PROMPT` and `$MODEL` variables directly within a double-quoted string passed to the `curl` command, which allows for arbitrary command execution via command substitution (e.g., `$(cmd)`) if the input is not sanitized. While the script's stated purpose is to provide a legitimate interface for the vwu.ai API, the lack of input escaping in the shell script constitutes a significant security vulnerability.