vwu.ai Sora Models

Access and use sora-2 model on vwu.ai platform via OpenAI-compatible chat API with required API key configuration.

This skill appears to be a simple wrapper for vwu.ai's chat API, but there are several mismatches and small risks you should consider before installing: - The package metadata says no env vars are required, but the script demands VWU_API_KEY and also uses VWU_BASE_URL ( undocumented ). Ask the publisher to declare required environment variables and explain VWU_BASE_URL usage. - The script requires curl, jq, and a zsh-compatible shell but doesn't declare those binaries. Ensure your runtime has these binaries and review the script before running. - On quota errors the script prints the first 8 characters of your API key to the console. If you run this in shared logs or CI, that may leak part of your key—ask the maintainer to remove or further mask this. - Because VWU_BASE_URL can be overridden via environment, verify you only run this in environments where that variable is trusted; otherwise your key could be directed to an attacker-controlled endpoint. - The source and homepage are unknown; if you plan to use it regularly, obtain a trustworthy upstream/source, or reimplement a vetted client that documents required env vars and avoids logging key fragments. If you accept these caveats and verify the script yourself, the skill is usable; otherwise treat it cautiously or request fixes from the publisher.

Type: OpenClaw Skill Name: vwu-sora Version: 1.0.0 The skill provides a shell script (`vwu-chat.sh`) to interact with the vwu.ai API, but it contains a vulnerability due to a lack of input sanitization. The script directly interpolates the `$PROMPT` and `$MODEL` variables into a JSON payload for `curl`, which allows for JSON injection if the input contains unescaped double quotes or other control characters. While the behavior aligns with the stated purpose, this flaw represents a security risk in how the tool handles agent-provided data.