Back to skill
Skillv1.0.0
ClawScan security
MiniMax MMX · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 9, 2026, 3:19 AM
- Verdict
- benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill is an instruction-only wrapper describing how to use a MiniMax CLI; its requirements and instructions are mostly consistent with that purpose, with only minor documentation gaps (no install spec and the CLI's API key usage isn't declared as an environment requirement).
- Guidance
- This skill is an instruction-only guide for using a third-party mmx CLI. Before installing or using it: 1) Confirm the mmx-cli package exists on npm and is from a trusted publisher (the skill's source/homepage is not provided). 2) Understand that the CLI requires an API key (mmx auth login) — verify where that key will be stored (local CLI config) and avoid reusing high-privilege keys. 3) The agent will need access to the mmx binary or you must install it (npm install -g mmx-cli) in your environment. 4) Commands like vision describe operate on local files you supply; avoid passing sensitive system paths. 5) If you need higher assurance, request the package repository URL or vendor documentation and inspect the mmx-cli code before installing.
Review Dimensions
- Purpose & Capability
- noteThe skill describes use of an mmx CLI (install via npm is mentioned in prose) and all commands in SKILL.md are consistent with a multimodal CLI. However, the package installation is only mentioned in description text (npm install -g mmx-cli) and there is no declared install spec or required binary in the metadata. Also the instructions reference an API key-based auth flow but the skill does not declare any required environment variables for credentials. These are documentation/integration gaps rather than indicators of unrelated capabilities.
- Instruction Scope
- okSKILL.md instructs the agent to run mmx CLI commands (image/video/music/speech/search/vision/text). Commands reference user-provided file paths for image/vision operations and an auth command to supply an API key; they do not instruct the agent to read unrelated system files, aggregate extraneous data, or send data to unexpected endpoints. Scope stays within the CLI's functionality.
- Install Mechanism
- noteThere is no install spec or code included (instruction-only). The README mentions npm install -g mmx-cli, but the skill does not require or supply an install mechanism. This is not dangerous by itself but means the agent environment must already have mmx-cli available (or the operator must install it), which is a deployment consideration.
- Credentials
- noteThe SKILL.md shows an API-key based auth (mmx auth login --api-key <key>), implying a credential is needed, yet the skill metadata does not list any required environment variables or a primary credential. Requesting an API key via the CLI is reasonable, but the absence of declared credential requirements is an inconsistency the user should be aware of.
- Persistence & Privilege
- okThe skill does not request always:true and has no install-time persistence or cross-skill config changes. It relies on a local CLI which may persist its own auth tokens (normal for a CLI), but the skill itself does not request elevated platform privileges.