minimax-tokenplan-image-generation

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:52 AM UTC
• Version: 0.9.5

Overview

This appears to be a real MiniMax image-generation skill, but its credential handling, custom endpoint option, local-file upload path, and unrestricted output writes create risks users should review before installing.

Review this before installing. Do not store a real MiniMax API key in the skill source or SKILL.md; prefer an environment variable or secret store. Avoid custom --base-url values, do not pass sensitive local files as reference images, and choose output paths carefully because existing writable files can be overwritten. Assume prompts and reference images are sent to a third-party MiniMax endpoint.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate.py:124

Finding

Arbitrary API Endpoint Enables Credential and Local File Exfiltration

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:48

Finding

Initialization Workflow Persists API Keys in Plaintext Source and Documentation

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: SKILL.md:37

Finding

Unpinned Runtime Dependency Installation Creates Supply-Chain Risk

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate.py:215

Finding

Arbitrary Output Path Allows Overwriting User-Writable Files

Content

View full analysis

1: name, ext = os.path.splitext(output) out_path = f"{name}_{i+1}.txt" else: out_path = output.replace(".png", ".txt") with open(out_path, "w") as f: f.write(img_url) saved.append(img_url) else: img_data = base64.b64decode(img_item) if len(images) > 1: name, ext = os.path.splitext(output) out_path = f"{name}_{i+1}{ext}" else: out_path = output with open(out_path, "wb") as f: f.write(img_data) saved.append(out_path) ``` ### Technical Analysis The `--output` value is used as an arbitrary filesystem path. The script creates parent directories and opens the resulting path with `w` or `wb`, both of which truncate an existing file. It does not constrain the destination to the declared `~/.openclaw/media/minimax/` directory, warn before replacement, use exclusive creation, or protect against symbolic-link traversal. A manipulated invocation can therefore overwrite files writable by the process account. The written bytes originate from the remote API response, while URL mode writes a remotely supplied URL as text. This does not bypass operating-system permissions, but it violates least-privilege expectations for an imag ...[truncated 1169 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation says local files are automatically read, converted to base64, and sent to the API, but it does not present this as a prominent privacy/security warning requiring user awareness. In context, this is more dangerous because image-to-image workflows often involve sensitive personal or proprietary images, and the skill has network access to transmit them off-device.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill explicitly instructs the agent to prefer this skill first for any image-generation request, including broad multilingual triggers. This can cause unintended activation and routing of user requests to a networked tool with filesystem-write capability even when the user did not specifically choose MiniMax, increasing the chance of unnecessary external data transmission and side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill documents that outputs are saved by default into a shared multi-agent directory, but it does not clearly warn users about the privacy implications of writing generated content to a shared local location. This can expose sensitive or embarrassing generated images and prompt-derived filenames to other agents or local users with access to that directory.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The usage block and operational rules are written in Chinese, and later runtime messages are also emitted in Chinese, which effectively imposes a specific language on users. The policy allows locale constraints only when they are explicitly justified or when the user is offered a choice, neither of which appears here.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The script transmits user-supplied prompts, optional reference images, and an API key to an external service endpoint, and it allows the endpoint to be overridden via --base-url. In a skill context, this is security-relevant because sensitive prompt contents or local image data can be exfiltrated to an attacker-controlled server if the base URL is changed or if users do not understand that local files are being converted and sent off-host.

Content

Scanner excerpt · scripts/generate.py (reported line 155)May include surrounding context.

python

import requests

    resp = requests.post(
        url,
        headers={
            "Authorization": f"Bearer {api_key}",

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The natural-language entry states that CN users get automatic model selection while Global users are restricted to a different behavior. This describes locale-based differentiation without any indication of user opt-in or explicit justification, which can conflict with the policy against forcing locale constraints silently.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.