MiniMax CLI Web Search
PassAudited by VirusTotal on May 11, 2026.
Overview
Type: OpenClaw Skill Name: minimax-cli-web-search Version: 0.1.1 The skill bundle is a well-structured wrapper for the `mcporter` CLI tool to perform web searches. The `SKILL.md` provides clear, non-malicious instructions for the agent and explicitly addresses security concerns like API key exposure and temporary file safety. The `minimax_web_search.sh` script uses robust shell practices (`set -euo pipefail`, `mktemp`, `trap`), performs input validation, and interacts with `mcporter` as intended. There is no evidence of data exfiltration, malicious execution (e.g., `eval` of user input, `curl|bash`), persistence mechanisms, obfuscation, or prompt injection attempts against the agent. Any potential vulnerability would lie in the `mcporter` dependency itself, not in the design or intent of this wrapper skill.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent may execute the local mcporter search command when using this skill.
The skill invokes a local CLI wrapper and an MCP tool using the user-provided search query. This is central to the stated web-search purpose and arguments are quoted, but users should understand that the agent can run this local command.
timeout "$TIMEOUT_SECONDS" mcporter call minimax.web_search query="$QUERY_EFF"
Install and configure mcporter only from a trusted source, and use the skill for intended web-search tasks.
Searches may use your configured MiniMax account or API quota.
The skill depends on a MiniMax API key through the local MCP configuration. This is expected for the service integration, and the artifacts instruct not to print key values.
Ensure MiniMax API key is configured for the minimax MCP server.
Use a dedicated or least-privileged API key where possible, and do not paste secrets into search queries.
Users may need to manually verify the local tooling and configuration before the skill works.
The registry metadata does not declare provenance, required binaries, or credential expectations even though the skill documentation and script rely on local mcporter/MiniMax configuration. This is an under-declaration note, not evidence of malicious behavior.
Source: unknown; Homepage: none; Required binaries (all must exist): none; Env var declarations: none; Primary credential: none
Confirm the mcporter installation and MiniMax MCP configuration are trusted and working before enabling the skill.
Anything included in a search query may be transmitted to the configured MiniMax MCP/web-search service.
The skill sends search queries through a configured MCP service. This is disclosed and purpose-aligned, but queries may leave the local environment via that provider.
Use this skill to run web search through MiniMax MCP from CLI, then return clean, source-first results.
Avoid including private, confidential, or credential-like data in search queries unless you intend to share it with the configured provider.