Security audit
Security checks for vulnerabilities and agentic risk
This skill is a small vwu.ai chat wrapper, but it can send prompts and an API key to an undocumented, environment-controlled endpoint.
Review before installing. Only use this with a vwu.ai API key you are comfortable using for model calls, avoid placing secrets or regulated data in prompts, and make sure VWU_BASE_URL is unset or explicitly trusted. The script should ideally validate HTTPS vwu.ai endpoints and JSON-encode prompt/model values before broad use.
vwu-chat.sh:6Attacker-Controlled API Endpoint Can Receive Credentials and Prompts
vwu-chat.sh:29Unescaped User Input Permits JSON Request Manipulation
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
# 调用模型
vwu-chat --model MiniMax-Hailuo-02 "你的问题"
The skill instructs users to set an API key and send prompts to vwu.ai, but it does not disclose that user inputs will be transmitted to an external third-party service. This creates a real privacy and data-governance risk because users may unknowingly submit sensitive prompts, credentials, or proprietary data to a remote provider.
The script transmits both user-supplied prompt content and the bearer token to an externally configurable endpoint via VWU_BASE_URL, with no validation that the host is trusted. If an attacker can influence the environment variable or persuade a user to point it at a malicious server, prompts and credentials could be exfiltrated to an attacker-controlled endpoint.
fi
# 调用 API
response=$(curl -s "$VWU_BASE_URL/v1/chat/completions" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $VWU_API_KEY" \
-d "{
This code transmits the user-supplied prompt to a remote service and includes an Authorization bearer token, which is a safety-relevant network operation. While the script has error messages, it does not provide any prior disclosure, confirmation, or explanatory comment warning that prompt content will be sent to an external API.
SQP-3 applies to natural-language policy issues in all file types, including markdown. The content appears to force a specific language for instructions and warnings, which may violate a language-choice policy when no opt-in or justification is provided.
The script's comments, usage text, and error messages are written in Chinese throughout, which imposes a specific language on all users. There is no opt-in, fallback, or documentation that this skill is intentionally limited to Chinese-speaking users or a Chinese-only environment.