vwu.ai Veo Models

调用 vwu.ai 平台上的 veo 系列模型，支持五个版本，兼容 OpenAI API，需配置 VWU_API_KEY 后使用。

Security Scan

The skill appears to implement what it claims (calling vwu.ai veo models) but has several inconsistencies and small risks (missing metadata declarations, undocumented VWU_BASE_URL override, and undeclared binary dependencies) that you should review before installing.

Purpose & Capability

The script and SKILL.md match the stated purpose: calling vwu.ai veo models using an API key. However the registry metadata does not declare the required environment variable (VWU_API_KEY) or the binary dependencies (curl, jq), which is an incoherence between what the skill needs and what it declares.

Instruction Scope

SKILL.md documents only VWU_API_KEY but the script also reads VWU_BASE_URL (defaults to https://vwu.ai) — that env var is undocumented. Allowing VWU_BASE_URL to be overridden means API requests (and the API key) could be redirected to an arbitrary endpoint if someone sets that env var. The script reads the included models.txt and prints a masked prefix of the API key on quota errors (exposes first 8 characters). Otherwise the instructions stick to the stated task and do not access unrelated files.

Install Mechanism

No install spec (instruction-only with an included script). Nothing is downloaded or installed by the skill itself, which minimizes install-time risk.

Credentials

Requiring VWU_API_KEY is proportional to the skill's purpose, but the skill metadata failed to declare it. The script also relies on curl and jq (not declared). The undocumented VWU_BASE_URL env var increases risk because it can be used to redirect traffic (and the API key) to other hosts. The script reveals the first 8 characters of the API key in some error messages, which is unnecessary exposure.

Persistence & Privilege

The skill is not always-enabled and is user-invocable; it does not request elevated privileges or modify other skills or system-wide configs.

What to consider before installing

This skill mostly does what it says (calls vwu.ai models), but there are a few red flags you should address before trusting it: 1) The registry metadata does not declare VWU_API_KEY or the script's binary dependencies (curl, jq) — expect to set these yourself. 2) The script honors an undocumented VWU_BASE_URL environment variable; if someone sets that to an attacker-controlled host your API key and prompts could be sent there. Only run this script when VWU_BASE_URL is unset or explicitly set to https://vwu.ai. 3) The script prints the first 8 characters of your API key on quota errors — consider removing that behavior and rotate your key if it has been exposed. 4) There's no verified homepage or publisher info — prefer an official source or verify the script contents before use. Recommended actions: inspect the vwu-chat.sh file yourself, run it in a restricted environment, ensure curl and jq are present, set VWU_BASE_URL only to the official host, and use a limited/revocable API key.

veo Models for vwu.ai

vwu.ai 平台上的 veo 模型调用技能。

支持的模型

• veo-2.0-generate-001
• veo-3.0-fast-generate-001
• veo-3.0-generate-001
• veo-3.1-fast-generate-preview
• veo-3.1-generate-preview

共 5 个模型。

配置

使用前需要设置 vwu.ai API key:

export VWU_API_KEY="your-key-here"

获取 key: https://vwu.ai 控制台

使用示例

# 调用模型
vwu-chat --model veo-2.0-generate-001 "你的问题"

API 兼容性

所有模型兼容 OpenAI API 格式，支持标准 chat completions 接口。

额度提示

如果使用时提示"额度不足"或类似错误：

1. 访问 https://vwu.ai
2. 在控制台充值或调整额度
3. 或生成新的 API key

---

由 Claw 自动生成 | 源数据: vwu.ai