← 返回 Skills 市场
267
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install vwu-minimax
功能描述
Call minimax models MiniMax-Hailuo series on vwu.ai with OpenAI-compatible chat completions using your configured API key.
安全使用建议
This skill generally does what it claims (wraps vwu.ai chat completions), but there are some issues to consider before installing: 1) The registry metadata omits the required VWU_API_KEY and doesn't list required CLI tools (zsh, curl, jq, grep, sed). Expect to set VWU_API_KEY in your environment and ensure the tools are installed. 2) The script prints the first 8 characters of your API key on API errors — avoid using a sensitive/reused key or ensure logs are not exposed; ask the author to remove that behavior. 3) Confirm you trust vwu.ai and the skill source (there is no homepage/source link). If you need stronger assurance, request the publisher add explicit required-env and required-binaries metadata, remove the API-key echo, and publish a trustworthy source/homepage before use.
功能分析
Type: OpenClaw Skill
Name: vwu-minimax
Version: 1.0.0
The skill bundle provides a shell script wrapper for the vwu.ai API. The file `vwu-chat.sh` contains a vulnerability where user-provided variables ($MODEL and $PROMPT) are directly injected into a JSON string for a `curl` command without proper escaping or sanitization. This allows for potential JSON injection, which, per the analysis guidelines, is classified as suspicious due to the lack of input sanitization.
能力评估
Purpose & Capability
The skill's name, SKILL.md, models.txt, and vwu-chat.sh all align: they call vwu.ai's OpenAI-compatible chat completions for MiniMax models. However the registry metadata lists no required env vars or primary credential even though both the README and the script require VWU_API_KEY (and optionally VWU_BASE_URL). This metadata omission is an inconsistency that should be corrected.
Instruction Scope
SKILL.md instructs only to set VWU_API_KEY and how to call vwu-chat; the included vwu-chat.sh uses only VWU_API_KEY and an optional VWU_BASE_URL and calls the vwu.ai /v1/chat/completions endpoint. It does not read unrelated system paths. Concern: on API error the script prints a partially redacted API key (${VWU_API_KEY:0:8}***), which leaks the first 8 characters of the key to console logs/errors — unnecessary and increases risk if logs are collected.
Install Mechanism
There is no install spec (instruction-only), which is low risk. However the provided script assumes certain CLI tools are available (zsh shebang, curl, jq, grep, sed). The registry metadata lists no required binaries; that mismatch could cause runtime failures and should be declared.
Credentials
Requesting an API key for vwu.ai is proportional and expected. But the skill metadata does not declare VWU_API_KEY as required/primary credential, creating an unclear trust surface. Additionally, the script's partial-key echo on error leaks a secret fragment to stdout/stderr — not justified by the task.
Persistence & Privilege
The skill does not request persistent presence, does not set always:true, and does not modify other skill/system configs. It runs a simple CLI wrapper and exits; no privilege escalation or persistent agents are present.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install vwu-minimax - 安装完成后，直接呼叫该 Skill 的名称或使用
/vwu-minimax触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
Initial release - Complete vwu.ai model collection
元数据
常见问题
vwu.ai MiniMax Models 是什么？
Call minimax models MiniMax-Hailuo series on vwu.ai with OpenAI-compatible chat completions using your configured API key. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 267 次。
如何安装 vwu.ai MiniMax Models？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install vwu-minimax」即可一键安装，无需额外配置。
vwu.ai MiniMax Models 是免费的吗？
是的，vwu.ai MiniMax Models 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
vwu.ai MiniMax Models 支持哪些平台？
vwu.ai MiniMax Models 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 vwu.ai MiniMax Models？
由 a3273283（@a3273283）开发并维护，当前版本 v1.0.0。
推荐 Skills