Minimax Vision Search

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:01 AM UTC
• Version: 1.1.2

Overview

The skill’s image and web-search functions are coherent, but it relies on unpinned external tooling with an API key and includes unsafe installer guidance.

Review before installing. Avoid the curl-to-sh installer path, prefer a pinned and reviewed MCP package, use a narrowly scoped MiniMax key, and do not submit sensitive images, URLs, or search queries unless you are comfortable sending them through MiniMax tooling. Clean up any Telegram images stored under ~/.openclaw/media/inbound if they may contain private data.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/setup.md:20
• Finding: Remote Installer Downloaded and Executed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Locations**: - `references/setup.md:20-22` - `references/troubleshooting.md:18-22` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code `references/setup.md:20-22`: ```bash **Fallback: Official installer (curl|sh)** ```bash curl -LsSf https://astral.sh/uv/install.sh | sh ``` ``` `references/troubleshooting.md:18-22`: ```bash ### "uvx not found" Install uvx: ```bash curl -LsSf https://astral.sh/uv/install.sh | sh ``` ``` ### Technical Analysis Both instructions pipe an HTTP response directly into the user's shell. Although the URL uses HTTPS and appears to reference the official `uv` installer, the downloaded content is mutable and is executed without: - Pinning a specific installer version or immutable artifact. - Verifying a cryptographic signature. - Comparing a pinned checksum. - Saving and inspecting the script before execution. - Restricting the installer within a sandbox. Transport encryption does not protect against compromise of the upstream domain, hosting infrastructure, publishing account, or installer itself. A compromised endpoint can return arbitrary shell commands that execute immediately with the privileges of the user following the documentation. Installing `uv` is necessary for the declared functionality, but piping mutable remote content directly into a shell is not the minimum-risk or minimum-privilege installation method. ### Attack Path 1. An attacker compromises the upstream installer endpoint, its hosting infrastructure, DNS resolution, or an authorized publishing account. 2. The attacker changes the response from `https://astral.sh/uv/install.sh` to include malicious shell commands. 3. A user follows either documented installation command. 4. `curl` downloads the attacker-controlled response. 5. The pipe sends the response directly to `sh` without an opportunity for validation. 6. The payload executes with the invoking user's per ...[truncated 728 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all `curl | sh` installation instructions. 2. Prefer trusted system package managers, such as the already documented Homebrew method: ```bash brew install uv ``` 3. If a standalone installer is required: - Select a fixed, immutable release. - Download it to a local file without executing it. - Verify a publisher signature or a SHA-256 checksum obtained through a trusted channel. - Inspect the downloaded artifact before execution. - Execute it only after verification. 4. Document installation in a non-privileged user context and discourage unnecessary use of `sudo`. 5. Apply the remediation consistently to both `references/setup.md` and `references/troubleshooting.md`. ]]>

T08 · Insecure Dependencies

Error

• Location: scripts/understand_image.py:40
• Finding: Unpinned MCP Package Is Retrieved and Executed with API Credentials<![CDATA[ ## Vulnerability Details **File Locations**: - `scripts/understand_image.py:21-28, 40-45` - `scripts/web_search.py:21-28, 39-44` - `references/setup.md:15-18` **Vulnerability Type**: Insecure dependency execution **Risk Level**: High ### Vulnerable Code `scripts/understand_image.py:21-28, 40-45`: ```python # Build environment with required variables # Only pass necessary environment variables (avoid leaking other secrets) env = { 'PATH': os.environ.get('PATH', ''), 'MINIMAX_API_KEY': api_key, 'MINIMAX_API_HOST': os.environ.get('MINIMAX_API_HOST', 'https://api.minimaxi.com'), 'MINIMAX_MCP_BASE_PATH': '/tmp/mcporter-output', } try: proc = subprocess.Popen( ['uvx', 'minimax-coding-plan-mcp'], stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, env=env, text=True ) ``` `scripts/web_search.py:21-28, 39-44`: ```python # Build environment with required variables # Only pass necessary environment variables (avoid leaking other secrets) env = { 'PATH': os.environ.get('PATH', ''), 'MINIMAX_API_KEY': api_key, 'MINIMAX_API_HOST': os.environ.get('MINIMAX_API_HOST', 'https://api.minimaxi.com'), 'MINIMAX_MCP_BASE_PATH': '/tmp/mcporter-output', } try: proc = subprocess.Popen( ['uvx', 'minimax-coding-plan-mcp'], stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, env=env, text=True ) ``` `references/setup.md:15-18`: ```bash **Alternative: pipx** ```bash pipx install uv ``` ``` ### Technical Analysis The functional scripts execute `minimax-coding-plan-mcp` through `uvx` without specifying an exact version or validating package integrity. This permits the resolved package contents to change after the Skill has been reviewed. If `uvx` does not already have an appropriate local environment, it may retrieve a current package release and execute its code. Consequently, normal Skill use can become a download-and-execute operation co ...[truncated 2098 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `minimax-coding-plan-mcp` to an exact, reviewed version rather than resolving an unconstrained current release. 2. Maintain a lockfile containing cryptographic hashes for all direct and transitive dependencies. 3. Install dependencies during a controlled setup phase rather than implicitly retrieving executable code during each normal Skill invocation. 4. Verify package publisher provenance and monitor the pinned package for ownership changes or compromised releases. 5. Pin installation tooling such as `uv` to an approved version where practical. 6. Run the MCP component with operating-system sandboxing or container isolation that restricts: - Filesystem access. - Network destinations. - Process creation. - Access to unrelated user resources. 7. Provide the API credential only for the duration of the request and use a narrowly scoped, revocable key. 8. Document clearly that image-analysis data, prompts, search queries, and the API credential are entrusted to the MCP component and MiniMax service. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (30)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: There is a material description-behavior mismatch for this code chunk. The declared purpose says the skill analyzes images and searches the web, but the provided code only performs pre-publication setup and validation checks. While these checks may support the skill, this specific code does not implement the declared end-user functionality. It also accesses local environment variables and system executables, which are not reflected in the declared purpose or permissions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The code chunk's behavior is narrowly focused on image understanding: it validates `MINIMAX_API_KEY`, starts `uvx minimax-coding-plan-mcp`, sends MCP requests for initialization and a single `tools/call` to `understand_image`, and prints the returned analysis. There is no logic for web searching, browsing, or calling any search-related tool. Therefore, the declared description overstates the implemented functionality in this code chunk. The external API/subprocess use is consistent with MiniMax MCP usage, but the omission of any declared permissions may be mildly inconsistent.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The description claims two capabilities: image analysis and web search using MiniMax MCP tools. The actual code only performs web search through the `web_search` MCP tool. It does not accept image inputs, invoke any image-analysis tool, or process image data. The subprocess execution and environment variable handling are supporting implementation details consistent with web search, not undeclared harmful capabilities. Therefore this is a description-behavior mismatch due to missing declared image-analysis functionality in the supplied code.

Chaining Abuse

High

• Category: Tool Misuse

Content

**Fallback: Official installer (curl|sh)**
```bash
curl -LsSf https://astral.sh/uv/install.sh | sh
```

## Step 2: Set API Key (Environment Variable)

• Confidence: 98% confidence
• Finding: The command explicitly chains untrusted network input into shell execution via `| sh`, which is dangerous because it turns any upstream compromise into immediate code execution. This pattern materially increases exploitability compared with merely downloading a file, since it bypasses review and encourages blind execution.

Chaining Abuse

High

• Category: Tool Misuse

Content

Install uvx:
```bash
curl -LsSf https://astral.sh/uv/install.sh | sh
```

### "MCP server offline"

• Confidence: 97% confidence
• Finding: The `| sh` pattern is dangerous because it chains remote content retrieval directly into shell execution, making command review and validation unlikely. In a troubleshooting document, users are especially prone to copy-paste such commands under time pressure, which raises practical exploitation risk.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill declares operational requirements for environment variables and a binary but does not define an explicit tool or permission scope, while its stated workflow clearly implies shell execution and outbound network use. In an agent environment, that gap can cause users or orchestrators to invoke the skill without understanding that it may access secrets and external services.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill encourages users to supply local image paths, image URLs, Telegram-sourced files, and search queries, but does not warn that these inputs may be transmitted to external MiniMax services. This creates a real privacy and data-handling risk because users may unintentionally submit sensitive images, URLs, or queries to a third party.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README states that Telegram images are automatically saved to a local directory, but it does not clearly warn users about the privacy and data-retention implications of storing potentially sensitive user images on disk. In an image-analysis skill, users may reasonably assume transient processing, so undocumented local persistence increases the risk of unintended exposure through shared accounts, backups, or weak filesystem permissions.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The guide recommends piping a remotely fetched script directly into the shell, which removes the user's opportunity to inspect the script before execution and creates a supply-chain execution path if the remote host, transport, or published installer is compromised. In a setup document for developer tooling, this is especially risky because readers are likely to run the command verbatim on their workstation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The setup guide instructs users to export an API key and append it directly into a shell profile without warning about risks such as plaintext credential persistence, accidental disclosure through dotfile syncing/backups, or exposure to other local users/processes. While common in developer docs, omitting safer handling guidance can lead to credential leakage and long-lived compromise of the associated MiniMax account.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The troubleshooting guide instructs users to modify shell startup files and execute a remote installer without any warning about persistence or system impact. While common in developer docs, these actions can permanently alter a user's environment and increase the chance of unsafe copy-paste execution, especially when paired with network-fetched scripts.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 65% confidence
• Finding: uvx/uv tool run commands without ==version create a rug-pull risk.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 65% confidence
• Finding: uvx/uv tool run commands without ==version create a rug-pull risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

Check network and API key:
```bash
curl -H "Authorization: Bearer $MINIMAX_API_KEY" https://api.minimaxi.com/v1/models
```

### Webchat images don't work

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 65% confidence
• Finding: uvx/uv tool run commands without ==version create a rug-pull risk.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 65% confidence
• Finding: uvx/uv tool run commands without ==version create a rug-pull risk.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def check_uvx():
    """Check if uvx is installed."""
    print("1. Checking uvx installation...")
    result = subprocess.run(['which', 'uvx'], capture_output=True, text=True)
    if result.returncode == 0:
        print(f"   ✓ uvx found at: {result.stdout.strip()}")
        return True

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 65% confidence
• Finding: uvx/uv tool run commands without ==version create a rug-pull risk.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

for script in scripts:
        path = os.path.join(script_dir, script)
        if os.path.exists(path):
            result = subprocess.run(['python3', '-m', 'py_compile', path], 
                                   capture_output=True, text=True)
            if result.returncode == 0:
                print(f"   ✓ {script} is valid Python")

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The skill executes an MCP server via uvx without pinning an exact package version or trusted source, which can cause different code to be fetched and run over time. Because the launched tool receives the API key in its environment and handles attacker-influenced inputs, a compromised or substituted package could exfiltrate credentials or execute arbitrary behavior.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The manifest describes a skill for analyzing images and searching the web using MiniMax MCP tools. While web search itself is in-scope, directly reading credentials from environment variables is a separate sensitive capability that is not stated in the manifest and is not inherent from the user-facing purpose alone.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

]

    try:
        proc = subprocess.Popen(
            ['uvx', 'minimax-coding-plan-mcp'],
            stdin=subprocess.PIPE, stdout=subprocess.PIPE,
            stderr=subprocess.PIPE, env=env, text=True

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

]

    try:
        proc = subprocess.Popen(
            ['uvx', 'minimax-coding-plan-mcp'],
            stdin=subprocess.PIPE, stdout=subprocess.PIPE,
            stderr=subprocess.PIPE, env=env, text=True

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Tainted flow: 'env' from os.environ.get (line 23, credential/environment) → subprocess.Popen (code execution)

Medium

• Category: Data Flow

Content

]

    try:
        proc = subprocess.Popen(
            ['uvx', 'minimax-coding-plan-mcp'],
            stdin=subprocess.PIPE, stdout=subprocess.PIPE,
            stderr=subprocess.PIPE, env=env, text=True

• Confidence: 65% confidence
• Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Tainted flow: 'env' from os.environ.get (line 23, credential/environment) → subprocess.Popen (code execution)

Medium

• Category: Data Flow

Content

]

    try:
        proc = subprocess.Popen(
            ['uvx', 'minimax-coding-plan-mcp'],
            stdin=subprocess.PIPE, stdout=subprocess.PIPE,
            stderr=subprocess.PIPE, env=env, text=True

• Confidence: 65% confidence
• Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Static analysis

No suspicious patterns detected.