vwu.ai MiniMax Models

• Analyzed: May 11, 2026, 6:51 AM
• Findings: 1
• Version: 1.0.0
• Hash: d45992f958bd4cd101dc686581783a3d98e0e325e3608c83a0e3adfd27584238
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides a shell script wrapper for the vwu.ai API. The file `vwu-chat.sh` contains a vulnerability where user-provided variables ($MODEL and $PROMPT) are directly injected into a JSON string for a `curl` command without proper escaping or sanitization. This allows for potential JSON injection, which, per the analysis guidelines, is classified as suspicious due to the lack of input sanitization.