Security audit

Vidu

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its stated video-generation purpose, but it needs Review because it can send API keys, prompts, and images to an environment-controlled endpoint and encourages persistent plaintext key storage.

Install only if you are comfortable sending prompts, selected images, and your VWU API key to the configured API service. Before use, avoid storing the key directly in shell startup files, check that VWU_BASE_URL is unset or points only to the intended HTTPS vwu.ai endpoint, and treat prompts/images as data that will leave your machine.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: vwu-video.sh:7
Finding: Arbitrary API Endpoint Override Can Expose Credentials and User Data
Content: View full analysis
Vulnerability Details

File Locations: vwu-video.sh:7-8, 151-159; vwu-chat.sh:6-7, 31-38
Vulnerability Type: Unvalidated credential destination
Risk Level: High

Vulnerable Code

vwu-video.sh:

bash
VWU_API_KEY="${VWU_API_KEY:-}" VWU_BASE_URL="${VWU_BASE_URL:-https://api.vwu.ai}"

bash
response=$(curl -s -w "\n%{http_code}" "$VWU_BASE_URL/v1/videos" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $VWU_API_KEY" \ -d "{ \"model\": \"$model\", $prompt_json, \"metadata\": $metadata }" 2>&1)

vwu-chat.sh:

zsh
VWU_API_KEY="${VWU_API_KEY:-}" VWU_BASE_URL="${VWU_BASE_URL:-https://vwu.ai}"

zsh
response=$(curl -s "$VWU_BASE_URL/v1/chat/completions" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $VWU_API_KEY" \ -d "{ \"model\": \"$MODEL\", \"messages\": [{\"role\": \"user\", \"content\": \"$PROMPT\"}], \"stream\": false }")

Technical Analysis

Both scripts accept VWU_BASE_URL from the inherited process environment without validating its scheme, hostname, port, or ownership. They subsequently send the VWU_API_KEY through an HTTP Authorization header to the configured destination.

The video client also sends prompts and optional base64-encoded local images to this destination. The chat client sends user prompts. An attacker who can influence the execution environment can therefore redirect these requests to an attacker-controlled server.

The override is not documented as a required feature in SKILL.md, and no hostname allowlist or explicit user confirmation protects credential transmission. Although the default video endpoint uses HTTPS, the variable can be changed to an unrelated HTTPS host or even a plaintext HTTP endpoint.

Attack Path

An attacker influences the environment used to launch the Skill, suc ...[truncated 1091 chars]
Remediation: View remediation
Remediation Suggestions

Pin production requests to the expected endpoint instead of accepting an inherited environment override:
bash
readonly VWU_BASE_URL="https://api.vwu.ai"

If custom endpoints are essential, parse and validate the URL before sending credentials.

Require the https scheme and enforce an exact hostname allowlist.

Reject user-information components, unexpected ports, redirects to different hosts, and malformed URLs.

Configure curl to fail on HTTP errors and restrict protocols:
bash
curl --fail-with-body --proto '=https' --proto-redir '=https' ...

Do not forward the Authorization header across redirects to unrelated hosts.

Require an explicit command-line option and user confirmation for any non-production endpoint.

Document custom endpoint behavior and clearly warn that credentials and request content are sent to that endpoint.

T09 · Insecure Skill Coding Practices

Warning

Location: vwu-video.sh:137
Finding: Unsafe JSON Construction Allows Request-Body Injection
Content: View full analysis
Vulnerability Details

File Locations: vwu-video.sh:137-159; vwu-chat.sh:31-38
Vulnerability Type: JSON injection through unescaped arguments
Risk Level: Medium

Vulnerable Code

vwu-video.sh:

bash
# 构建 JSON payload metadata="{\"duration\": $duration, \"aspect_ratio\": \"$ratio\"}" if [ -n "$image" ]; then # 如果有图片，转换为 base64 if [ ! -f "$image" ]; then echo -e "${RED}❌ 错误: 图片文件不存在: $image${NC}" exit 1 fi image_base64=$(base64 -i "$image" | tr -d '\n') prompt_json="\"prompt\": \"$prompt\", \"image\": \"data:image/jpeg;base64,$image_base64\"" else prompt_json="\"prompt\": \"$prompt\"" fi # 调用 API response=$(curl -s -w "\n%{http_code}" "$VWU_BASE_URL/v1/videos" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $VWU_API_KEY" \ -d "{ \"model\": \"$model\", $prompt_json, \"metadata\": $metadata }" 2>&1)

vwu-chat.sh:

zsh
response=$(curl -s "$VWU_BASE_URL/v1/chat/completions" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $VWU_API_KEY" \ -d "{ \"model\": \"$MODEL\", \"messages\": [{\"role\": \"user\", \"content\": \"$PROMPT\"}], \"stream\": false }")

Technical Analysis

User-controlled values are inserted directly into JSON strings without JSON encoding:

model

prompt

duration

ratio

Quotes, backslashes, control characters, commas, and JSON delimiters in these values are interpreted as JSON syntax rather than data. An attacker can therefore add sibling properties, create duplicate properties, alter object structure, or make the payload invalid.

For example, a video prompt resembling the following introduces an additional property:

text
x", "input_reference": "attacker-controlled

The generated fragment becomes:

json
"prompt": "x", "inp ...[truncated 1643 chars]
Remediation: View remediation
Remediation Suggestions

Never construct JSON through string interpolation.

Generate request bodies with jq, passing all strings through --arg and validated numeric values through --argjson.

For example:
bash
payload=$(jq -n \ --arg model "$model" \ --arg prompt "$prompt" \ --arg ratio "$ratio" \ --argjson duration "$duration" \ '{ model: $model, prompt: $prompt, metadata: { duration: $duration, aspect_ratio: $ratio } }')

Add the image field using jq --arg image "$image_data" rather than constructing a partial JSON fragment.

Validate duration using a strict integer expression and enforce the supported range.

Allowlist supported aspect ratios such as 16:9, 9:16, and 1:1.

Allowlist supported model identifiers where practical.

Submit the resulting payload with curl --data-binary "$payload".

Add tests covering quotation marks, backslashes, newlines, Unicode, duplicate-key attempts, and malformed numeric arguments.

T09 · Insecure Skill Coding Practices

Note

Location: SKILL.md:53
Finding: Documentation Encourages Persistent Plaintext API-Key Storage
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:53-58
Vulnerability Type: Insecure credential storage guidance
Risk Level: Low

Vulnerable Code

bash
export VWU_API_KEY="sk-your-key-here"

bash
echo 'export VWU_API_KEY="sk-your-key-here"' >> ~/.zshrc source ~/.zshrc

Technical Analysis

The documentation recommends appending the API key directly to a shell startup file. This stores the credential in plaintext for an indefinite period and automatically exports it to every process launched from future interactive shells.

Shell configuration files may be copied into backups, included in diagnostic archives, read by other software executing as the same user, or accidentally committed with other configuration files. Exporting the key globally also increases its exposure to child processes that do not require API access.

The example uses a placeholder rather than a real embedded secret, so the project itself does not contain a hardcoded operational credential. The weakness is the recommended storage practice.

Attack Path

A user follows the documented recommendation and writes a real API key into ~/.zshrc.

The credential remains in plaintext and is loaded into every subsequent shell environment.

Another process running as that user, an exposed backup, a support archive, or an accidentally published configuration repository obtains the file or environment value.

The attacker extracts the key and uses it against the API.

Impact Assessment

Disclosure can permit unauthorized API calls and quota consumption within the permissions of the exposed key. It can also allow access to any API resources available to that credential.

This does not independently elevate local privileges. Exploitation generally requires existing access to the user's files, environment, backups, or accidentally published configuration data.
Remediation: View remediation
Remediation Suggestions

Remove the recommendation to store the key directly in ~/.zshrc or ~/.bashrc.

Prefer an operating-system credential manager, dedicated secret manager, or runtime secret injection mechanism.

Scope the credential only to commands that require it instead of globally exporting it.

If file-based storage is unavoidable, use a dedicated file with permissions restricted to the owner:
bash
install -m 600 /dev/null ~/.config/vwu/secrets

Ensure secret files are excluded from version control, backups where appropriate, logs, and diagnostic archives.

Document key rotation and revocation procedures.

Recommend a narrowly scoped API key with quota controls and the minimum permissions needed.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (10)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation advises users to append the API key directly into a shell startup file, which stores a long-lived credential in plaintext on disk. This increases the chance of accidental disclosure through backups, dotfile syncing, shared accounts, local compromise, or screenshots/logging, especially because no warning or safer alternative is provided.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · vwu-chat.sh (reported line 32)May include surrounding context.
sh
fi # 调用 API response=$(curl -s "$VWU_BASE_URL/v1/chat/completions" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $VWU_API_KEY" \ -d "{

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code sends the user-supplied prompt to a remote service and includes the bearer API key in the request, but there is no confirmation prompt, user-facing notice, or explanatory comment warning that prompt content will leave the local system. For code files, network calls that transmit user or system data should have some visible disclosure unless the warning is documented elsewhere, which is not evident in this file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script's comments, help output, errors, and status messages are all presented in Chinese with no option to select another language. This imposes a locale/language choice on all users rather than offering opt-in or documenting a justified region-specific constraint.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.
md
#!/bin/bash # vwu.ai 视频生成脚本 - 支持 Vidu/Kling/Veo 等模型 # 使用正确的 API 端点: https://api.vwu.ai/v1/videos set -e

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · vwu-video.sh (reported line 3)May include surrounding context.
sh
#!/bin/bash # vwu.ai 视频生成脚本 - 支持 Vidu/Kling/Veo 等模型 # 使用正确的 API 端点: https://api.vwu.ai/v1/videos set -e

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The script reads an API key from the environment and sends user-supplied prompts plus optional image content to a third-party API, but it does not provide an explicit privacy or data-transmission warning at execution time. This is dangerous because users may unknowingly transmit sensitive text or images off-host, and the script also allows the destination host to be changed via VWU_BASE_URL, increasing the chance of accidental or unintended disclosure.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 92% confidence
Finding: This call performs external transmission of user prompts, optional base64-encoded image data, and an authorization bearer token to a remote API. In the context of a local agent skill, that is security-relevant because sensitive local content can be exfiltrated to a third party, and the target URL is indirectly configurable through VWU_BASE_URL.
Content: Scanner excerpt · vwu-video.sh (reported line 140)May include surrounding context.
sh
fi # 调用 API response=$(curl -s -w "\n%{http_code}" "$VWU_BASE_URL/v1/videos" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $VWU_API_KEY" \ -d "{

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The natural-language instructions, examples, and operational guidance are presented exclusively in Chinese, which effectively forces a specific language for users without opt-in. The stated policy flags language or locale constraints unless the skill offers a choice or clearly documents and justifies the restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script's user-facing messages, usage guidance, and error text are written in Chinese only, with no option for the user to select another language or locale. This can violate language/locale policy when a skill imposes a specific language without explicit user opt-in or documented justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

SkillSpector

Missing User Warnings

External Transmission

Missing User Warnings

Natural-Language Policy Violations

External Transmission

External Transmission

Missing User Warnings

External Transmission

Natural-Language Policy Violations

Natural-Language Policy Violations

Static analysis