ClawHub
Back to skill

Security audit

Mmx Text Researcher

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent MiniMax research helper, with the main caution that broad research prompts may be sent to an external CLI service.

Install this if you intend to use MiniMax for web-backed research. Verify that your `mmx` CLI is from a trusted source, use a revocable API key where possible, and avoid sending secrets, personal data, or confidential business material unless external MiniMax processing is acceptable.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The activation description is broad enough to match many ordinary knowledge requests, which can cause the skill to trigger outside its intended niche. Over-broad routing increases the chance that the agent invokes external CLI-based research workflows unnecessarily, expanding attack surface and causing unintended tool use, data exposure to third-party services, or degraded decision quality.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The common trigger list contains generic conversational phrases such as 'find information about' and 'what is the current state of', which are likely to overlap with normal user queries. This makes accidental activation more likely and can route routine interactions into a more powerful external research path, increasing unnecessary external calls and making prompt- or tool-routing behavior easier to influence.

Static analysis

No suspicious patterns detected.