AB Agents Vision

👁️ Image analysis using MiniMax VL API. Describe images, extract text from screenshots, analyze photos. Works with local files and URLs. Simple shell wrapper.

Security Scan

The skill appears to implement image analysis via the MiniMax VL API (which fits its description) but contains inconsistencies and risky installation/user guidance (undeclared API key requirement, a remote curl|sh installer suggestion, and a script that reads a local credential file and alters PATH).

Purpose & Capability

The code and SKILL.md implement an image-analysis wrapper for MiniMax (calls a minimax tool via 'uvx' and uses a MINIMAX_API_KEY) which matches the stated purpose. However the registry metadata declares no required environment variables while both the docs and the script require MINIMAX_API_KEY — a clear metadata/instruction mismatch. The script also adds /root/.local/bin to PATH which is unusual and unnecessary for the stated functionality.

Instruction Scope

SKILL.md instructs the user to install 'uv' by piping a remote install script (curl ... | sh). The runtime script reads MINIMAX_API_KEY from either the environment or from ~/.minimax-env (grep), which means it will access a local credentials file in the user's home directory. Reading that file is outside the nominal scope (the key itself is required, but implicit fallback file access is a privacy/clarity concern). The instructions do not document these behaviors in the registry metadata.

Install Mechanism

There is no formal install spec in the package; SKILL.md recommends running a remote installer via 'curl -LsSf https://astral.sh/uv/install.sh | sh', which is high-risk (running remote code without checks). The script relies on the external 'uvx' tool that would be installed by that script. No checksums or explicit trusted package sources are provided in the skill docs.

Credentials

Functionality legitimately requires a MiniMax API key (MINIMAX_API_KEY), so requiring one is proportionate. But the registry metadata omits this requirement. The script's fallback to read ~/.minimax-env means it will access a local file containing credentials — this access should be declared up front. No unrelated credentials appear to be requested.

Persistence & Privilege

The skill does not request permanent presence (always:false), does not modify other skills' configs, and does not write persistent files itself. The only runtime change is a temporary PATH mutation. Autonomous invocation is allowed by default but not a special privilege here.

What to consider before installing

This skill largely does what it claims (wraps MiniMax VL), but there are several issues to consider before installing: - Metadata mismatch: The registry says no environment variables are required, but both SKILL.md and vision.sh require MINIMAX_API_KEY. Treat the API key as required and ensure you provide a dedicated key. - Remote installer risk: The README suggests running 'curl ... | sh' to install 'uv'. Running remote install scripts without verification is risky — inspect the script at https://astral.sh/uv/install.sh before running, or install the tool from a trusted package source or your distro's package manager. - Local credential file read: vision.sh will try to read ~/.minimax-env to extract MINIMAX_API_KEY. If you keep secrets in that file, be aware the script will access it. Consider storing the key in a controlled location or set MINIMAX_API_KEY in the environment explicitly. - PATH tweak: The script prepends /root/.local/bin to PATH at runtime which is odd and may hide which binary is being invoked; review the tool installed as 'uvx' and confirm it is what you expect. Recommended actions before use: inspect vision.sh and the uv install script yourself, avoid piping unknown scripts to sh, set MINIMAX_API_KEY explicitly in your shell environment (not relying on fallback files), and verify the uvx/minimax client being installed is from a trusted source. If you need higher assurance, ask the package owner for a signed release or an install method that uses a well-known package registry or package manager.

Image analysis using MiniMax VL API — simple, fast, reliable.

What It Does

• 📸 Describe images — Get detailed scene descriptions
• 📝 Extract text — Read text from screenshots, photos, documents
• 🔍 Analyze photos — Identify objects, people, settings
• 🌐 URL support — Analyze images from the web

Quick Start

# Install
curl -LsSf https://astral.sh/uv/install.sh | sh

# Set your MiniMax API key
export MINIMAX_API_KEY="sk-cp-your-key"

# Use
./vision.sh image.jpg "Describe this image"

Usage

# Basic description
./vision.sh photo.jpg

# With custom prompt
./vision.sh screenshot.png "What text do you see?"

# URL support
./vision.sh "https://example.com/image.jpg" "Describe this"

Requirements

• MiniMax Token Plan API key (get one)
• Linux/macOS
• uvx (auto-installed via script)

Examples

Screenshot analysis:

Input: screenshot.png + "What text is in the image?"
Output: "The screenshot shows a code editor with Python code...

Photo description:

Input: photo.jpg + "Describe in detail"
Output: "A person's bare foot and lower leg resting on a brown
textured waffle-weave blanket. The skin is light-toned with
visible fine hairs..."

Installation

git clone https://github.com/alexburrstudio/ab-agents-skills.git
cd ab-agents-skills/skills/vision
chmod +x vision.sh

Or via ClaWHub:

clawhub install AB-Agents-Vision

Troubleshooting

Error	Solution
API Error: 1033	Retry — system error on MiniMax side
No response	Check MINIMAX_API_KEY is set correctly
Slow	Use smaller images (<10MB)

---

AB-Agents 🦀