minimax-tokenplan-tts

This skill appears to implement the claimed MiniMax TTS functionality, but take these precautions before installing/using it: - Do NOT paste your API key into the top of the scripts. Instead pass it on the command line or modify the code to read MINIMAX_API_KEY from the environment (safer than hard-coding). - The streaming script disables SSL verification (accepts any certificate). This makes the API key vulnerable to interception on hostile or misconfigured networks. If you plan to use streaming, edit stream_play.py to enable certificate verification (remove the lines that set check_hostname=False and verify_mode=CERT_NONE) or ensure you use a trusted network. - The SKILL.md metadata references a download URL (clawhub.ai) rather than the MiniMax domain; prefer obtaining code from trusted sources or verify the included files' contents. Since the package already includes scripts, prefer using the bundled code rather than invoking any external installer from unknown hosts. - Avoid leaving secrets in code or in version-controlled files. If you must store credentials locally, use environment variables or a secrets manager and confirm the script reads them securely. - Review and test on an isolated environment first (or with a non-production API key) before allowing the agent to call this skill autonomously. If the maintainer can: (1) remove the hard-coded API_KEY placeholder and read MINIMAX_API_KEY from env by default, and (2) enable proper SSL verification in the websocket client, the remaining concerns would be largely addressed and my confidence would increase.