vwu.ai OpenAI Models

调用 vwu.ai 平台上的多款 GPT-4 和 GPT-5 系列模型，兼容 OpenAI API，支持标准聊天补全接口。

This skill appears to do what it says: call vwu.ai models using an API key. Before installing, verify you trust vwu.ai and obtain your API key from their console. Note the registry metadata omits the required VWU_API_KEY — the SKILL.md and script both require it, so you will need to set it yourself. If you are conservative about secrets, inspect the vwu-chat.sh file (it’s small) and be aware it prints a masked prefix of your key to the console on quota errors and allows overriding VWU_BASE_URL via env var (avoid setting VWU_BASE_URL to untrusted addresses). If you want extra caution, run the script in a restricted environment or review network traffic to confirm it only talks to https://vwu.ai.

Type: OpenClaw Skill Name: vwu-openai Version: 1.0.0 The skill facilitates interaction with a third-party API service (vwu.ai) that claims access to non-existent models (e.g., gpt-5.1, gpt-5.2), which is a common indicator of deceptive services or potential credential harvesting. Technically, the script `vwu-chat.sh` is vulnerable to JSON injection because it inserts the user prompt directly into a JSON string within a `curl` command without proper escaping or using a tool like `jq` to construct the payload safely. While there is no evidence of local data exfiltration, the promotion of non-existent AI models and the lack of input sanitization are significant red flags.