vwu.ai OpenAI Models

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:29 AM UTC
• Version: 1.0.0

Overview

This is a coherent vwu.ai chat helper, but it needs review because an undocumented endpoint override can redirect the API key and prompts.

Install only if you trust vwu.ai and your execution environment. Before use, treat prompts as data sent to a remote provider, avoid putting secrets in prompts, and ensure VWU_BASE_URL is unset or pinned to a trusted HTTPS endpoint so your API key is not sent elsewhere.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: vwu-chat.sh:6

Finding

Configurable API endpoint permits bearer credential and prompt redirection

Content

View full analysis

Vulnerability Details

File Location: vwu-chat.sh, lines 6-7 and 31-39
Vulnerability Type: Unrestricted credential destination
Risk Level: High

Vulnerable Code

zsh

VWU_API_KEY="${VWU_API_KEY:-}"
VWU_BASE_URL="${VWU_BASE_URL:-https://vwu.ai}"

zsh

response=$(curl -s "$VWU_BASE_URL/v1/chat/completions" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer $VWU_API_KEY" \
    -d "{
        \"model\": \"$MODEL\",
        \"messages\": [{\"role\": \"user\", \"content\": \"$PROMPT\"}],
        \"stream\": false
    }")

Technical Analysis

The destination of the authenticated API request is taken directly from the environment variable VWU_BASE_URL. The script does not validate the URL scheme or verify that the destination host is vwu.ai or another explicitly trusted service.

The same request includes VWU_API_KEY as a bearer credential and includes the user's prompt. Consequently, any process or launch configuration capable of controlling the script's environment can redirect both sensitive values to an arbitrary endpoint. The destination can also use unencrypted HTTP because the script does not restrict the URL scheme to HTTPS.

This behavior exceeds the documented configuration, which only instructs users to configure VWU_API_KEY and presents vwu.ai as the intended service.

Attack Path

1. An attacker influences the execution environment through a wrapper script, shell profile, CI configuration, task runner, or compromised parent process.
2. The attacker sets VWU_BASE_URL to an endpoint under their control, such as https://attacker.example.
3. A user configures a valid VWU_API_KEY and invokes vwu-chat.sh with a model and prompt.
4. The script sends a request to https://attacker.example/v1/chat/completions.
5. The attacker receives the bearer API key, selected model, and complete prompt in the request.

Impact Assessment

...[truncated 657 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the configurable base URL if alternate endpoints are not a required feature:

  zsh

  readonly VWU_BASE_URL="https://vwu.ai"
  

• If endpoint configurability is necessary, parse the URL and enforce an explicit allowlist of trusted HTTPS schemes, hostnames, and ports before attaching the Authorization header.
• Configure curl to reject non-HTTPS protocols:

  zsh

  curl --proto '=https' --tlsv1.2 ...
  

• Do not disable TLS certificate verification.
• If redirects are enabled in the future, prevent credentials from being forwarded to a different host. Avoid broad redirect options such as --location-trusted.
• Consider separating endpoint selection from credential selection so that each allowed host has a dedicated credential and an untrusted endpoint can never receive the vwu.ai key.
• Document any supported endpoint override and its trust implications.

T09 · Insecure Skill Coding Practices

Warning

• Location: vwu-chat.sh:34

Finding

Unescaped model and prompt values allow JSON request-body injection

Content

View full analysis

Vulnerability Details

File Location: vwu-chat.sh, lines 34-39
Vulnerability Type: JSON injection through unsafe string interpolation
Risk Level: Medium

Vulnerable Code

zsh

-d "{
    \"model\": \"$MODEL\",
    \"messages\": [{\"role\": \"user\", \"content\": \"$PROMPT\"}],
    \"stream\": false
}")

Technical Analysis

The script constructs JSON by directly interpolating the attacker-controllable MODEL and PROMPT shell variables into a quoted JSON template. It does not apply JSON escaping to quotation marks, backslashes, control characters, or newlines.

A normal prompt containing such characters can produce malformed JSON and cause request failure. A deliberately crafted value can terminate its intended JSON string and add properties to the surrounding object. For example, a crafted model argument can introduce additional top-level request properties while retaining syntactically valid JSON. The remote parser's handling of injected or duplicate properties determines the exact behavioral effect.

Shell command substitution is not introduced by this issue because shell metacharacters contained in expanded variables are not reparsed as shell syntax. The vulnerability is request-data injection rather than shell command injection.

Attack Path

1. An attacker controls or influences a model or prompt argument passed to vwu-chat.sh, such as through an automated wrapper that forwards untrusted input.
2. The attacker includes quotation marks and JSON syntax that close the intended string and introduce additional properties.
3. The shell interpolates the value verbatim into the request body.
4. The script submits the attacker-shaped JSON using the victim's API credential.
5. If accepted by the API, the injected properties alter request behavior; otherwise, malformed input causes request failure.

Impact Assessment

Exploitation can compromise the integrity of API requests made un ...[truncated 539 chars]

Remediation

View remediation

Remediation Suggestions

Construct the request body with a JSON-aware encoder rather than string interpolation:

zsh

payload=$(jq -n \
    --arg model "$MODEL" \
    --arg prompt "$PROMPT" \
    '{
        model: $model,
        messages: [
            {role: "user", content: $prompt}
        ],
        stream: false
    }')

response=$(curl -sS "$VWU_BASE_URL/v1/chat/completions" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer $VWU_API_KEY" \
    --data-binary "$payload")

Additionally:

• Validate MODEL against the exact entries in models.txt if arbitrary model identifiers are not required.
• Preserve prompts as opaque strings and rely exclusively on the JSON encoder for escaping.
• Use curl -sS --fail-with-body and explicitly handle transport failures, non-success HTTP status codes, and invalid JSON responses.
• Add tests covering quotation marks, backslashes, multiline prompts, tabs, Unicode content, and attempted JSON-property injection.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

bash

# 调用模型
vwu-chat --model gpt-4.1 "你的问题"

API 兼容性

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file contains user-facing instructions exclusively in Chinese, including configuration and usage guidance. Under the policy rule for language/locale, forcing a single language without user opt-in or a documented regional justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · vwu-chat.sh (reported line 32)May include surrounding context.

sh

fi

# 调用 API
response=$(curl -s "$VWU_BASE_URL/v1/chat/completions" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer $VWU_API_KEY" \
    -d "{

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This shell script sends the user-supplied prompt to a remote service and includes the bearer API credential in the request, but there is no comment, usage text, or other disclosure warning that user input will be transmitted off-system. For code files, remote transmission of user or system data should have some visible disclosure unless clearly covered elsewhere, and no such warning appears in this file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The natural-language comments and all user-facing messages are presented only in Chinese, which forces a specific language without any visible opt-in or locale selection. The policy allows justified locale constraints, but this file does not document that the skill is intentionally region- or language-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.