← 返回 Skills 市场
264
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install vwu-tts
功能描述
调用 vwu.ai 语音合成模型speech-2.8-hd和speech-2.8-turbo，需配置API key并支持OpenAI兼容接口。
安全使用建议
Before installing: (1) confirm the registry metadata is corrected to list VWU_API_KEY as a required credential. (2) Ensure curl and jq are available on the agent runtime or adjust the script; SKILL.md should mention these prerequisites. (3) Be cautious about VWU_BASE_URL — it can redirect requests to any host if you or an attacker sets that env var; don't set it unless you trust the host. (4) Note the script prints the first 8 characters of your API key on quota errors — consider rotating keys if you expose logs to others. (5) The SKILL.md usage example and the script's argument parsing differ; test locally first. If any item is unclear, ask the publisher to clarify or provide a corrected SKILL.md and registry metadata before use.
功能分析
Type: OpenClaw Skill
Name: vwu-tts
Version: 1.0.0
The script vwu-chat.sh contains a shell injection vulnerability because it expands the $PROMPT and $MODEL variables directly within a double-quoted string passed to curl without proper escaping or using jq to construct the JSON payload safely. This could allow an attacker to execute arbitrary commands or manipulate the API request. While the behavior aligns with the stated purpose of calling the vwu.ai API, the lack of input sanitization is a significant security flaw.
能力评估
Purpose & Capability
Skill name/description (vwu.ai TTS models) align with the code and SKILL.md: the script calls vwu.ai chat completions for the two listed models. However, the registry metadata claims no required env vars or primary credential while the SKILL.md and the included script clearly require VWU_API_KEY — this mismatch is inconsistent and should be corrected.
Instruction Scope
SKILL.md instructs setting VWU_API_KEY and calling a CLI, which matches the script, but it omits mention of VWU_BASE_URL (the script allows overriding the endpoint). The script also assumes curl and jq are available (SKILL.md/registry do not declare binaries). The script prints a masked but partially-identifying prefix of the API key on quota errors, which is a small leakage. The SKILL.md example uses a --model flag but the script expects positional args, a usability/instruction mismatch.
Install Mechanism
No install spec (instruction-only with a small shell script). That is low risk because nothing is automatically downloaded or installed by the skill bundle itself.
Credentials
Only VWU_API_KEY is needed for operation, which is proportionate — but the registry metadata does not declare this required credential. Also the script exposes the first 8 characters of the key on certain errors and accepts VWU_BASE_URL (undocumented) which could be pointed at a non-official endpoint if an environment variable is set.
Persistence & Privilege
The skill does not request permanent presence (always:false) and does not modify other skills or system-wide settings.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install vwu-tts - 安装完成后，直接呼叫该 Skill 的名称或使用
/vwu-tts触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
Initial release - Complete vwu.ai model collection
元数据
常见问题
vwu.ai TTS Models 是什么？
调用 vwu.ai 语音合成模型speech-2.8-hd和speech-2.8-turbo，需配置API key并支持OpenAI兼容接口。 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 264 次。
如何安装 vwu.ai TTS Models？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install vwu-tts」即可一键安装，无需额外配置。
vwu.ai TTS Models 是免费的吗？
是的，vwu.ai TTS Models 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
vwu.ai TTS Models 支持哪些平台？
vwu.ai TTS Models 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 vwu.ai TTS Models？
由 a3273283（@a3273283）开发并维护，当前版本 v1.0.0。
推荐 Skills