Minimax Use

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:40 AM UTC
• Version: 0.1.0

Overview

The skill mostly does what it claims, but its API host override and image upload handling can expose API keys and local file contents too broadly.

Install only if you trust the MiniMax endpoint configuration and are comfortable sending prompts, chat history, searches, translations, and selected image files to MiniMax or the configured host. Avoid setting MINIMAX_API_HOST to anything other than the official MiniMax API endpoint, and do not pass sensitive local files to image analysis unless you intend to upload them.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/__main__.py:21

Finding

Unvalidated API Host Override Exposes Credentials and User Data to Arbitrary Servers

Content

View full analysis

dict: """Perform web search""" if not MINIMAX_API_KEY: return {"success": False, "error": "MINIMAX_API_KEY not set. Please set MINIMAX_API_KEY environment variable."} url = f"{MINIMAX_API_HOST}/v1/coding_plan/search" headers = { "Authorization": f"Bearer {MINIMAX_API_KEY}", "Content-Type": "application/json" } payload = {"q": query} try: response = requests.post(url, headers=headers, json=payload, timeout=30) ``` The same pattern is used by the image-analysis, chat, and streaming-chat functions: ```python url = f"{MINIMAX_API_HOST}/v1/coding_plan/vlm" headers = { "Authorization": f"Bearer {MINIMAX_API_KEY}", "Content-Type": "application/json" } response = requests.post(url, headers=headers, json=payload, timeout=60) ``` ```python url = f"{MINIMAX_API_HOST}/v1/messages" headers = { "Authorization": f"Bearer {MINIMAX_API_KEY}", "Content-Type": "application/json", "anthropic-version": "2023-06-01" } response = requests.post(url, headers=headers, json=payload, timeout=120) ``` ### Technical Analysis The optional `MINIMAX_API_HOST` environment variable completely controls the origin receiving requests, but the value is not parsed or validated before use. In particular, the implementation does not: - Require HTTPS. - Verify that the hostname belongs to MiniMax. - Reject embedded credentials, unexpected ports, or malformed URLs. - Require explicit approval before transmitting the bearer token to ...[truncated 2034 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/__main__.py:72

Finding

Image Analysis Accepts and Uploads Arbitrary Readable Local Files

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (18)

Tainted flow: 'url' from os.environ.get (line 236, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 98% confidence

Finding

The request destination is derived from MINIMAX_API_HOST, an environment variable, and the code sends the Bearer API key plus user data to that host with no allowlist or validation. If an attacker can influence the runtime environment, they can redirect traffic to an attacker-controlled server and exfiltrate credentials, prompts, chat history, translations, search queries, and image data.

Content

Scanner excerpt · scripts/__main__.py (reported line 48)May include surrounding context.

python

payload = {"q": query}

    try:
        response = requests.post(url, headers=headers, json=payload, timeout=30)
        response.raise_for_status()
        data = response.json()

Tainted flow: 'url' from os.environ.get (line 236, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 98% confidence

Finding

This image-analysis request uses a URL built from MINIMAX_API_HOST and includes the API key in the Authorization header. Because understand_image may also embed local file contents as base64 and send them to the remote host, a hostile or misconfigured environment can cause sensitive local images and credentials to be transmitted to an attacker-controlled endpoint.

Content

Scanner excerpt · scripts/__main__.py (reported line 100)May include surrounding context.

python

}

    try:
        response = requests.post(url, headers=headers, json=payload, timeout=60)
        response.raise_for_status()
        data = response.json()

Tainted flow: 'url' from os.environ.get (line 236, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 98% confidence

Finding

The chat function posts prompts, optional system instructions, and prior conversation history to a host controlled by MINIMAX_API_HOST while authenticating with MINIMAX_API_KEY. If that host is redirected, the code leaks the API secret and potentially sensitive conversation data to an untrusted server.

Content

Scanner excerpt · scripts/__main__.py (reported line 182)May include surrounding context.

python

payload["system"] = system

    try:
        response = requests.post(url, headers=headers, json=payload, timeout=120)
        response.raise_for_status()
        data = response.json()

Tainted flow: 'url' from os.environ.get (line 236, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 98% confidence

Finding

The streaming chat path has the same host-taint problem: it sends prompts and the Authorization bearer token to a URL derived from an environment variable without validation. This enables credential exfiltration and interception of sensitive streamed model interactions if the environment is compromised or misconfigured.

Content

Scanner excerpt · scripts/__main__.py (reported line 270)May include surrounding context.

python

payload["system"] = system

    try:
        response = requests.post(url, headers=headers, json=payload, timeout=120, stream=True)
        response.raise_for_status()

        full_content = ""

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill documents use of environment variables and outbound network access to MiniMax, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and makes it harder for users or platforms to understand and constrain what the skill can access at runtime.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill handles sensitive user inputs including prompts, chat history, search queries, image contents, and translation text, and sends them to a third-party API, but the description does not clearly warn users about this data transmission. Users may unknowingly submit confidential information to an external service, creating privacy, compliance, and data-handling risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The image analysis documentation accepts a local file path or URL but does not warn that the referenced content may be uploaded to an external service for processing. In a skill context, this can lead users to unintentionally send sensitive local images or internal-only URLs to a third party, creating privacy and data handling risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The chat API sends message content, optional system prompts, and conversation history to an external LLM service, but the reference does not clearly warn users about that transmission. This increases the chance that secrets, internal data, or regulated information are pasted into prompts or history and disclosed to a third party.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md

# Read from system environment variables
MINIMAX_API_KEY = os.environ.get("MINIMAX_API_KEY")
MINIMAX_API_HOST = os.environ.get("MINIMAX_API_HOST", "https://api.minimaxi.com/anthropic")

# Available models
AVAILABLE_MODELS = {

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/API.md (reported line 8)May include surrounding context.

md

# Read from system environment variables
MINIMAX_API_KEY = os.environ.get("MINIMAX_API_KEY")
MINIMAX_API_HOST = os.environ.get("MINIMAX_API_HOST", "https://api.minimaxi.com/anthropic")

# Available models
AVAILABLE_MODELS = {

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/__main__.py (reported line 21)May include surrounding context.

python

# Read from system environment variables
MINIMAX_API_KEY = os.environ.get("MINIMAX_API_KEY")
MINIMAX_API_HOST = os.environ.get("MINIMAX_API_HOST", "https://api.minimaxi.com/anthropic")

# Available models
AVAILABLE_MODELS = {

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/__main__.py (reported line 48)May include surrounding context.

python

payload = {"q": query}

    try:
        response = requests.post(url, headers=headers, json=payload, timeout=30)
        response.raise_for_status()
        data = response.json()

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/__main__.py (reported line 100)May include surrounding context.

python

payload = {"q": query}

    try:
        response = requests.post(url, headers=headers, json=payload, timeout=30)
        response.raise_for_status()
        data = response.json()

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/__main__.py (reported line 182)May include surrounding context.

python

payload = {"q": query}

    try:
        response = requests.post(url, headers=headers, json=payload, timeout=30)
        response.raise_for_status()
        data = response.json()

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/__main__.py (reported line 270)May include surrounding context.

python

payload = {"q": query}

    try:
        response = requests.post(url, headers=headers, json=payload, timeout=30)
        response.raise_for_status()
        data = response.json()

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

When a non-URL image path is supplied, the code reads the local file, base64-encodes it, and uploads it to a remote API with no explicit warning or confirmation. In an agent skill context, users may not realize a local file is leaving the machine, which creates a real privacy and data-exfiltration risk for screenshots, documents, or other sensitive images.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file documents web_search(query, count=10) but does not disclose that the provided query is transmitted over the network to a third-party API endpoint. For markdown files, the rubric asks for warnings when behavior could affect privacy or user data, and search queries may contain sensitive information.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The translate function and CLI both default the target language to English, which imposes a language choice unless the user explicitly overrides it. This is a locale/language policy concern because the skill does not ask for or negotiate the user's preferred output language first.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.