AB-Agents-Vision-MiniMax

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:22 AM UTC
• Version: 1.0.5

Overview

This image-analysis skill does what it claims, but it relies on unsafe unpinned remote execution and silently reads a root-local API-key file.

Review this skill carefully before installing. Use only images and prompts you are allowed to send to MiniMax, prefer an explicitly exported low-scope MINIMAX_API_KEY, avoid running the documented curl-to-shell installer as root, and consider pinning or reviewing the minimax-coding-plan-mcp dependency before use.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:35

Finding

Unverified Remote Installer Executed Through a Shell Pipeline

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 35
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash

curl -LsSf https://astral.sh/uv/install.sh | sh

Technical Analysis

The installation instructions download a mutable script from an external URL and immediately execute it with sh. The downloaded content is not pinned to a specific version and is not verified using a cryptographic checksum or signature. Because it is never stored for inspection, users cannot meaningfully review the effective payload before execution.

HTTPS protects the connection in transit under ordinary conditions, but it does not protect users if the hosting infrastructure, DNS/TLS trust chain, or upstream installer itself is compromised. The behavior also exceeds the minimum privileges necessary for image analysis: the Skill only needs a known-compatible dependency, not arbitrary execution of whichever installer content the URL returns at installation time.

Attack Path

1. An attacker compromises the remote installer, its hosting infrastructure, or a relevant distribution channel.
2. The attacker changes the response from https://astral.sh/uv/install.sh to include malicious shell commands.
3. A user follows the documented Quick Start command.
4. curl sends the attacker-controlled response directly to sh.
5. The malicious commands execute with all privileges and filesystem access available to the invoking user.

Impact Assessment

Successful exploitation provides arbitrary command execution under the account running the installation command. If the command is run by an administrator or root, the payload could obtain full system control. Possible consequences include credential theft, file modification, additional payload installation, persistence, and compromise of other data accessible to the user.

Remediation

View remediation

Remediation Suggestions

• Remove the curl | sh installation instruction.
• Require users to install a specific, audited release of uv through a trusted package manager, or download a version-pinned release artifact.
• Verify the artifact against a vendor-published cryptographic signature or SHA-256 checksum before executing or installing it.
• Store downloaded installation material locally so it can be reviewed before execution.
• Perform installation using a non-root account and grant only the filesystem permissions required by the Skill.
• Document the exact supported dependency version and update it through a controlled review process.

T08 · Insecure Dependencies

Error

• Location: vision.sh:20

Finding

Unpinned Third-Party Package Downloaded and Executed at Runtime

Content

View full analysis

Vulnerability Details

File Location: vision.sh, line 20
Vulnerability Type: Insecure runtime dependency resolution
Risk Level: High

Vulnerable Code:

bash

} | uvx minimax-coding-plan-mcp 2>/dev/null | python3 -c "

Technical Analysis

The script invokes uvx minimax-coding-plan-mcp without specifying an exact package version or verifying package integrity. Depending on the local cache and package index state, uvx can retrieve and execute package code at runtime. This makes the effective executable mutable after the Skill itself has been reviewed.

The package process inherits the environment created by the wrapper, including MINIMAX_API_KEY and MINIMAX_API_HOST. It also runs with the invoking user's filesystem and process permissions. Consequently, compromise of the package publication account, package index, or a subsequently released version could turn an ordinary Skill invocation into arbitrary third-party code execution.

Runtime network installation is not required for the declared image-analysis function. A version-pinned and integrity-verified dependency can be installed during a controlled setup phase instead.

Attack Path

1. An attacker compromises the minimax-coding-plan-mcp distribution channel or publishes a malicious update under the resolved package identity.
2. A user invokes vision.sh.
3. uvx resolves the unpinned package and downloads or selects the malicious release.
4. The package executes with the user's privileges and inherits the MiniMax API credential.
5. The malicious dependency can read the credential and accessible files, alter API requests, communicate over the network, or execute additional commands.

Impact Assessment

Exploitation can result in arbitrary code execution with the permissions of the Skill process. The exposed scope includes the MiniMax API key, submitted prompts and image locations, files readable by the invoking account, and a ...[truncated 116 chars]

Remediation

View remediation

Remediation Suggestions

• Pin minimax-coding-plan-mcp to an exact audited version.
• Use a lockfile containing cryptographic hashes for all direct and transitive dependencies.
• Install dependencies during a controlled setup phase rather than downloading executable code on every invocation.
• Configure dependency resolution to use a trusted package index and reject artifacts whose hashes do not match the lockfile.
• Run the MCP package under a dedicated, unprivileged account or sandbox with restricted filesystem and network access.
• Limit credential exposure to the process that strictly requires it, and use a narrowly scoped, revocable API key.
• Surface dependency and execution errors rather than discarding all standard error output.

T09 · Insecure Skill Coding Practices

Warning

• Location: vision.sh:16

Finding

Prompt and Image Path Are Embedded into JSON Without Safe Encoding

Content

View full analysis

Vulnerability Details

File Location: vision.sh, lines 16–20
Vulnerability Type: JSON-RPC injection and malformed-request vulnerability
Risk Level: Medium

Vulnerable Code:

bash

{
    echo '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"vision","version":"1.0"}}}'
    sleep 1
    echo '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"understand_image","arguments":{"prompt":"'"$PROMPT"'","image_source":"'"$IMAGE_PATH"'"}}}'
} | uvx minimax-coding-plan-mcp 2>/dev/null | python3 -c "

Technical Analysis

PROMPT and IMAGE_PATH are concatenated directly into a JSON document. The shell quoting prevents ordinary shell metacharacters in these variables from being reinterpreted as shell syntax, but it does not perform JSON escaping.

Values containing double quotes, backslashes, control characters, or newlines can terminate or alter the intended JSON string. Because the downstream MCP implementation consumes line-oriented JSON-RPC input, newline-bearing input may also introduce additional protocol lines. At minimum, specially crafted input can produce malformed requests and denial of service; depending on the downstream server's accepted methods and parsing behavior, it may manipulate request fields or introduce unintended JSON-RPC messages.

Attack Path

1. An attacker controls or influences the prompt or image-path argument passed to vision.sh.
2. The attacker includes JSON delimiters, escape characters, or newline content in that argument.
3. The wrapper inserts the value into the JSON-RPC request without encoding it.
4. The generated request becomes malformed or contains attacker-influenced protocol structure.
5. The MCP process rejects the request, interprets altered fields, or processes an additional injected message if its protocol parser accepts the resulting stream.

Impact Assessme

...[truncated 414 chars]

Remediation

View remediation

Remediation Suggestions

• Construct the entire JSON-RPC request with a JSON-aware implementation rather than shell string concatenation.
• Pass the prompt and image source to Python through sys.argv, standard input, or carefully managed environment variables, then serialize them with json.dumps.
• Validate local image paths and explicitly permit only intended remote URL schemes such as HTTPS.
• Reject unsupported control characters where they are not required.
• Add tests covering quotes, backslashes, Unicode, tabs, and newlines in both arguments.
• Parse and report MCP errors instead of suppressing them, while ensuring error output does not expose API credentials.

T07 · Tool Hijacking and Spoofing

Warning

• Location: vision.sh:4

Finding

Executable Search Path Prioritizes a Root-Local Directory

Content

View full analysis

Vulnerability Details

File Location: vision.sh, line 4
Vulnerability Type: Executable path hijacking
Risk Level: Medium

Vulnerable Code:

bash

export PATH="/root/.local/bin:$PATH"

Technical Analysis

The script prepends /root/.local/bin to PATH and subsequently invokes uvx and python3 by name. A matching executable in the preferred directory will therefore run instead of a system binary appearing later in PATH.

This design relies on the integrity and ownership of an external directory without checking either property. It is also inconsistent with general Linux and macOS support because it hardcodes the root account's home directory. Exploitation requires an attacker to place or replace an executable in that directory, so practical severity depends on the directory's permissions and the account used to run the Skill. The audited files do not establish that an unprivileged attacker can write there.

Attack Path

1. An attacker obtains write access to /root/.local/bin through a separate permission weakness, compromised installation process, or prior privileged access.
2. The attacker places a malicious executable named uvx or python3 in that directory.
3. A user invokes vision.sh.
4. Shell path resolution selects the attacker-controlled executable before the expected system tool.
5. The spoofed executable runs with the Skill process's privileges and can capture inherited credentials and arguments.

Impact Assessment

If the directory can be modified by an attacker, successful exploitation provides code execution with the privileges of the account invoking the Skill. The malicious executable can access MINIMAX_API_KEY, prompts, image locations, and all files available to that account. If the process runs as root, the impact may extend to full system compromise. If /root/.local/bin is securely owned and writable only by root, exploitation by an unprivileged user is su ...[truncated 24 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the hardcoded /root/.local/bin path modification.
• Resolve required executables during setup and use validated absolute paths.
• Verify executable ownership and permissions before invocation.
• Refuse executables located in directories writable by untrusted users.
• Run the Skill as a dedicated non-root account with a minimal, controlled PATH.
• Use a project-specific virtual environment or locked tool installation rather than relying on a privileged user's private binary directory.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

Piping curl output directly into sh creates an immediate code-execution primitive with no review or integrity verification. In this skill context, the command appears in the quick-start path, making exploitation more likely because users are encouraged to run it verbatim during setup.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

bash

# 1. Install uvx
curl -LsSf https://astral.sh/uv/install.sh | sh

# 2. Get free MiniMax API key
# https://platform.minimax.io → Subscribe → Token Plan (free tier)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description promotes image analysis but does not clearly warn that local images and image URLs are transmitted to the external MiniMax VL API. This can cause inadvertent exfiltration of screenshots, documents, or other sensitive visual data because users may not realize third-party processing is occurring.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 82% confidence

Finding

The skill instructs users to install and invoke tooling obtained via unpinned remote sources (uvx and a curl-fetched installer), which weakens supply-chain integrity and reproducibility. If the upstream installer or resolved package changes or is compromised, users may execute unintended code during setup or runtime.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script automatically reads MINIMAX_API_KEY from /root/.openclaw/.minimax-env if the environment variable is unset, which expands its behavior from simple image analysis into credential discovery. This is dangerous because it silently harvests a secret from a privileged fixed path, reducing user awareness and increasing the blast radius if the script or its downstream dependency is compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script accesses sensitive credentials without any user-facing notice, consent prompt, or clear documentation at runtime. Silent secret access is risky in agent skills because users may believe they are only processing an image, while the skill is also retrieving authentication material that could be misused or leaked through logs, dependencies, or a compromised remote component.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script sends the user-provided image path and prompt to a remote MiniMax service through the MCP tool call, but it provides no warning that local content will leave the machine. In the context of an image-analysis skill, remote processing is functionally expected, but the lack of disclosure is still a real privacy and data-handling issue, especially for screenshots or photos containing secrets, personal data, or internal documents.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The script invokes an MCP server via uvx minimax-coding-plan-mcp without pinning an exact package version or verifying integrity. That creates a supply-chain risk: a malicious or compromised upstream release could execute attacker-controlled code when the skill runs, and because the script also handles API credentials and local file paths, compromise could expose secrets or local data.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The documentation tells users to fetch and execute a remote shell installer directly from the network. This is dangerous because any compromise of the hosting domain, CDN path, TLS interception point, or script publisher can immediately turn installation into arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

bash

# 1. Install uvx
curl -LsSf https://astral.sh/uv/install.sh | sh

# 2. Get free MiniMax API key
# https://platform.minimax.io → Subscribe → Token Plan (free tier)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill is primarily documented in English, but the support/instructions section switches to Russian-only text and donation messaging without user opt-in or justification. This creates a language/locale policy issue because it imposes a specific language on part of the skill documentation rather than offering an accessible choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.