vwu.ai Veo Models

调用 vwu.ai 平台上的 veo 系列模型，支持五个版本，兼容 OpenAI API，需配置 VWU_API_KEY 后使用。

This skill mostly does what it says (calls vwu.ai models), but there are a few red flags you should address before trusting it: 1) The registry metadata does not declare VWU_API_KEY or the script's binary dependencies (curl, jq) — expect to set these yourself. 2) The script honors an undocumented VWU_BASE_URL environment variable; if someone sets that to an attacker-controlled host your API key and prompts could be sent there. Only run this script when VWU_BASE_URL is unset or explicitly set to https://vwu.ai. 3) The script prints the first 8 characters of your API key on quota errors — consider removing that behavior and rotate your key if it has been exposed. 4) There's no verified homepage or publisher info — prefer an official source or verify the script contents before use. Recommended actions: inspect the vwu-chat.sh file yourself, run it in a restricted environment, ensure curl and jq are present, set VWU_BASE_URL only to the official host, and use a limited/revocable API key.

Type: OpenClaw Skill Name: vwu-veo Version: 1.0.0 The skill bundle provides a command-line interface for the vwu.ai API. However, the script `vwu-chat.sh` contains a shell injection vulnerability because it expands the `$PROMPT` and `$MODEL` variables directly within a double-quoted string in the `curl` command. This allows for arbitrary command execution on the host system if the input contains shell metacharacters (e.g., `$(command)` or backticks). While the script appears intended for legitimate API interaction, the lack of input sanitization poses a significant security risk.