Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
MiniMax Shader Dev
v1.0.0Comprehensive GLSL shader techniques for creating stunning visual effects — ray marching, SDF modeling, fluid simulation, particle systems, procedural genera...
⭐ 0· 89·2 current·2 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name and description align with the content of SKILL.md (GLSL/ShaderToy techniques). The skill does not request unrelated binaries, environment variables, or credentials, which is proportionate for a documentation/authoring skill. However, SKILL.md claims a directory structure containing ~36 technique files and a reference folder that are not present in the provided bundle/manifest — that mismatch is unexpected.
Instruction Scope
The instructions explicitly tell the agent to read files under techniques/ and reference/ and to use templates contained there. Because the package contains only SKILL.md, those read instructions cannot be satisfied locally. This can lead the agent to (a) attempt to fetch missing files from unknown external locations, (b) hallucinate file contents when generating code, or (c) produce incomplete or incorrect outputs. The instructions do not ask for system credentials or unrelated file paths, but their reliance on absent local files is a material scope/integrity issue.
Install Mechanism
No install spec is present and the skill is instruction-only, so nothing will be written to disk or installed by the platform. That's the lowest-risk install pattern and is coherent with a documentation-style skill.
Credentials
The skill declares no required environment variables, no primary credential, and no config paths. That is proportional for a shader technique reference skill and reduces risk of credential exposure.
Persistence & Privilege
The skill does not request always:true and uses normal defaults; it can be invoked by the user and the agent may call it autonomously (platform default). There is no evidence the skill attempts to modify other skills or system settings.
What to consider before installing
This skill's description and SKILL.md are plausible for a shader reference, but the runtime instructions expect many local technique and reference files that are not included. That makes the skill incomplete: the agent may try to fetch missing resources or invent content, which can produce incorrect or unexpected outputs. Before installing or enabling autonomous use, ask the publisher for the full package (all techniques/ and reference/ files) or verify those files are present. If you still want to try it, run it only with user invocation (not autonomous), do not provide any secrets, and review generated shader code carefully in a sandboxed environment. If the skill begins making network requests or requesting credentials to retrieve missing files, treat that as a red flag and disable it.Like a lobster shell, security has layers — review code before you run it.
developmentvk97emj1khn945f71586eh9ch9183ydg4glslvk97emj1khn945f71586eh9ch9183ydg4graphicsvk97emj1khn945f71586eh9ch9183ydg4latestvk97emj1khn945f71586eh9ch9183ydg4minimaxvk97emj1khn945f71586eh9ch9183ydg4officialvk97emj1khn945f71586eh9ch9183ydg4shadervk97emj1khn945f71586eh9ch9183ydg4
License
MIT-0
Free to use, modify, and redistribute. No attribution required.