Minimax Use

Security checks across static analysis, malware telemetry, and agentic risk

Overview

The skill appears to be a coherent MiniMax API wrapper, but prompts, chat history, translation text, search queries, and selected image files are sent to MiniMax using your API key.

This looks reasonable for a MiniMax integration. Before installing, confirm you trust MiniMax and the configured API host, use a limited API key if possible, and do not send private images, credentials, confidential documents, or sensitive chat history unless you are comfortable with that provider processing them.

Static analysis

No static analysis findings were reported for this release.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI03: Identity and Privilege Abuse
Low
What this means

Use of the skill may consume MiniMax API quota or billing tied to the configured key.

Why it was flagged

The skill uses a MiniMax account API key as a bearer token, which is expected for this integration but gives the skill access to make API calls under that account.

Skill content
MINIMAX_API_KEY = os.environ.get("MINIMAX_API_KEY") ... "Authorization": f"Bearer {MINIMAX_API_KEY}"
Recommendation

Use a dedicated MiniMax API key with appropriate limits, keep it private, and revoke or rotate it if you stop using the skill.

#
ASI07: Insecure Inter-Agent Communication
Low
What this means

Text, chat history, search terms, and selected image contents may leave the local environment and be processed by MiniMax.

Why it was flagged

For image analysis, the skill reads a user-supplied local file path, encodes the file, and posts it to the MiniMax API; chat, translation, and search functions similarly send user-supplied content to the provider.

Skill content
with open(image_source, "rb") as f: img_data = base64.b64encode(f.read()).decode("utf-8") ... requests.post(url, headers=headers, json=payload, timeout=60)
Recommendation

Avoid submitting sensitive or regulated content unless MiniMax's data handling terms meet your needs, and only set MINIMAX_API_HOST to a trusted endpoint.