vwu.ai TTS Models

调用 vwu.ai 语音合成模型speech-2.8-hd和speech-2.8-turbo，需配置API key并支持OpenAI兼容接口。

Before installing: (1) confirm the registry metadata is corrected to list VWU_API_KEY as a required credential. (2) Ensure curl and jq are available on the agent runtime or adjust the script; SKILL.md should mention these prerequisites. (3) Be cautious about VWU_BASE_URL — it can redirect requests to any host if you or an attacker sets that env var; don't set it unless you trust the host. (4) Note the script prints the first 8 characters of your API key on quota errors — consider rotating keys if you expose logs to others. (5) The SKILL.md usage example and the script's argument parsing differ; test locally first. If any item is unclear, ask the publisher to clarify or provide a corrected SKILL.md and registry metadata before use.

Type: OpenClaw Skill Name: vwu-tts Version: 1.0.0 The script vwu-chat.sh contains a shell injection vulnerability because it expands the $PROMPT and $MODEL variables directly within a double-quoted string passed to curl without proper escaping or using jq to construct the JSON payload safely. This could allow an attacker to execute arbitrary commands or manipulate the API request. While the behavior aligns with the stated purpose of calling the vwu.ai API, the lack of input sanitization is a significant security flaw.