vwu.ai gemini Models

调用vwu.ai平台上的五款gemini系列模型，支持标准OpenAI聊天接口，需配置vwu.ai API key后使用。

This skill legitimately calls vwu.ai and needs your vwu.ai API key, but the package metadata fails to declare that requirement and doesn't list runtime tools the script uses (curl, jq, zsh). Before installing: 1) Confirm you trust vwu.ai and are comfortable sending prompts to that external service; 2) Do not install unless you can supply a dedicated API key (and avoid reusing high-privilege keys); 3) Be aware the included script prints the first 8 characters of your API key in quota error messages (remove or change that behavior if you are concerned about logs leaking key fragments); 4) Ensure curl and jq are available in the runtime environment; 5) Prefer the maintainer update the skill metadata to declare VWU_API_KEY and required binaries and to publish source/homepage for audit. If you cannot verify the publisher or update metadata, treat this skill with caution.

Type: OpenClaw Skill Name: vwu-gemini Version: 1.0.0 The script `vwu-chat.sh` contains a command injection vulnerability because it expands the `$PROMPT` variable inside a double-quoted string within a `curl` command. This allows for arbitrary local command execution if the input contains shell metacharacters or substitutions (e.g., `$(...)` or backticks). While the bundle's stated purpose is to provide a wrapper for the `vwu.ai` API, the lack of input sanitization in the shell script constitutes a high-risk vulnerability.