vwu.ai kling Models

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:29 AM UTC
• Version: 1.0.0

Overview

The skill is a small vwu.ai chat helper, but an undocumented endpoint override can redirect prompts and the API bearer token to another host.

Review before installing. Use only in environments where sending prompts to vwu.ai is acceptable, keep VWU_API_KEY scoped and revocable, and do not set VWU_BASE_URL unless you fully trust that endpoint. Rotate the key if it may have been used with an untrusted base URL.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: vwu-chat.sh:6

Finding

Unvalidated API Endpoint Override Exposes Bearer Credentials and Prompt Data

Content

View full analysis

Vulnerability Details

File Location: vwu-chat.sh, lines 6–39
Vulnerability Type: Unvalidated destination for authenticated API requests
Risk Level: High

Vulnerable Code

zsh

VWU_API_KEY="${VWU_API_KEY:-}"
VWU_BASE_URL="${VWU_BASE_URL:-https://vwu.ai}"

if [ -z "$VWU_API_KEY" ]; then
    echo "❌ 错误: 未设置 VWU_API_KEY"
    echo ""
    echo "请按以下步骤获取 API key:"
    echo "1. 访问 https://vwu.ai"
    echo "2. 登录并进入控制台"
    echo "3. 在「令牌」页面生成新的 API key"
    echo "4. 设置环境变量: export VWU_API_KEY='your-key'"
    exit 1
fi

MODEL="${1:-}"
PROMPT="${2:-}"

if [ -z "$MODEL" ] || [ -z "$PROMPT" ]; then
    echo "用法: vwu-chat <model> <prompt>"
    echo ""
    echo "可用模型:"
    cat "$(dirname "$0")/models.txt" | sed 's/^/  - /'
    exit 1
fi

# 调用 API
response=$(curl -s "$VWU_BASE_URL/v1/chat/completions" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer $VWU_API_KEY" \
    -d "{
        \"model\": \"$MODEL\",
        \"messages\": [{\"role\": \"user\", \"content\": \"$PROMPT\"}],
        \"stream\": false
    }")

Technical Analysis

The script accepts VWU_BASE_URL directly from its inherited environment without validating the URL scheme, hostname, port, or ownership of the destination. It subsequently attaches VWU_API_KEY as an authorization bearer token to a request sent to that destination.

Consequently, any process, wrapper, CI configuration, shell profile, or other actor capable of influencing the script's environment can redirect the authenticated request from the intended https://vwu.ai service to an attacker-controlled endpoint. The endpoint override is also not disclosed in SKILL.md, reducing the likelihood that users will recognize this trust boundary.

The request body includes the model name and complete user prompt, so both authentication material and potentially sensitive prompt data are exposed when redirection o ...[truncated 1287 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the environment-controlled endpoint override if alternate servers are not a required feature:

   zsh

   readonly VWU_BASE_URL="https://vwu.ai"
   

2. If endpoint customization is required, validate the parsed destination against an explicit allowlist of trusted HTTPS hosts. Reject non-HTTPS schemes, unexpected ports, embedded credentials, malformed URLs, and unapproved subdomains.

3. Do not attach Authorization headers until the destination has passed validation. Keep authenticated requests restricted to the intended origin.

4. Ensure that redirects are not followed to another origin while retaining credentials. If redirect support is introduced later, revalidate every destination and strip authorization data from cross-origin requests.

5. Document all supported endpoint configuration behavior and its security implications in SKILL.md.

6. Construct the JSON request body with a JSON-aware tool rather than direct string interpolation:

   zsh

   payload=$(jq -n \
     --arg model "$MODEL" \
     --arg prompt "$PROMPT" \
     '{model: $model, messages: [{role: "user", content: $prompt}], stream: false}')
   
   response=$(curl --silent --show-error --fail-with-body \
     "https://vwu.ai/v1/chat/completions" \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer $VWU_API_KEY" \
     --data-binary "$payload")
   

7. Rotate any API key that may have been used while VWU_BASE_URL pointed to an untrusted destination, and review account usage for unauthorized requests.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The natural-language content describing setup and usage is entirely in Chinese, which effectively forces a specific language for users of the skill. The policy allows fixed language only when there is user opt-in or a clearly justified region-specific constraint, neither of which is stated here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script’s comments and user-facing messages are written in Chinese, including the usage, error, and remediation text. This imposes a specific language on users without opt-in or a documented region-specific justification, which matches the locale-policy violation criteria.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

The script sends the user-supplied prompt and bearer token to an external service via curl. In context, that is the script's intended function, but it still creates a real data-exposure boundary: sensitive prompts entered by users will be transmitted off-host to a third party, and the destination can be changed through VWU_BASE_URL, increasing the risk of accidental or malicious exfiltration to an untrusted endpoint.

Content

Scanner excerpt · vwu-chat.sh (reported line 32)May include surrounding context.

sh

fi

# 调用 API
response=$(curl -s "$VWU_BASE_URL/v1/chat/completions" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer $VWU_API_KEY" \
    -d "{

Static analysis

No suspicious patterns detected.