Minimax Vision Search

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:01 AM UTC
• Version: 1.1.2

Overview

The skill’s image and web-search functions are coherent, but it relies on unpinned external tooling with an API key and includes unsafe installer guidance.

Review before installing. Avoid the curl-to-sh installer path, prefer a pinned and reviewed MCP package, use a narrowly scoped MiniMax key, and do not submit sensitive images, URLs, or search queries unless you are comfortable sending them through MiniMax tooling. Clean up any Telegram images stored under ~/.openclaw/media/inbound if they may contain private data.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/setup.md:20

Finding

Remote Installer Downloaded and Executed Without Integrity Verification

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: scripts/understand_image.py:40

Finding

Unpinned MCP Package Is Retrieved and Executed with API Credentials

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (30)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

There is a material description-behavior mismatch for this code chunk. The declared purpose says the skill analyzes images and searches the web, but the provided code only performs pre-publication setup and validation checks. While these checks may support the skill, this specific code does not implement the declared end-user functionality. It also accesses local environment variables and system executables, which are not reflected in the declared purpose or permissions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The code chunk's behavior is narrowly focused on image understanding: it validates MINIMAX_API_KEY, starts uvx minimax-coding-plan-mcp, sends MCP requests for initialization and a single tools/call to understand_image, and prints the returned analysis. There is no logic for web searching, browsing, or calling any search-related tool. Therefore, the declared description overstates the implemented functionality in this code chunk. The external API/subprocess use is consistent with MiniMax MCP usage, but the omission of any declared permissions may be mildly inconsistent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description claims two capabilities: image analysis and web search using MiniMax MCP tools. The actual code only performs web search through the web_search MCP tool. It does not accept image inputs, invoke any image-analysis tool, or process image data. The subprocess execution and environment variable handling are supporting implementation details consistent with web search, not undeclared harmful capabilities. Therefore this is a description-behavior mismatch due to missing declared image-analysis functionality in the supplied code.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The command explicitly chains untrusted network input into shell execution via | sh, which is dangerous because it turns any upstream compromise into immediate code execution. This pattern materially increases exploitability compared with merely downloading a file, since it bypasses review and encourages blind execution.

Content

Scanner excerpt · references/setup.md (reported line 22)May include surrounding context.

Fallback: Official installer (curl|sh)

bash

curl -LsSf https://astral.sh/uv/install.sh | sh

Step 2: Set API Key (Environment Variable)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The | sh pattern is dangerous because it chains remote content retrieval directly into shell execution, making command review and validation unlikely. In a troubleshooting document, users are especially prone to copy-paste such commands under time pressure, which raises practical exploitation risk.

Content

Scanner excerpt · references/troubleshooting.md (reported line 22)May include surrounding context.

Install uvx:

bash

curl -LsSf https://astral.sh/uv/install.sh | sh

"MCP server offline"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill declares operational requirements for environment variables and a binary but does not define an explicit tool or permission scope, while its stated workflow clearly implies shell execution and outbound network use. In an agent environment, that gap can cause users or orchestrators to invoke the skill without understanding that it may access secrets and external services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill encourages users to supply local image paths, image URLs, Telegram-sourced files, and search queries, but does not warn that these inputs may be transmitted to external MiniMax services. This creates a real privacy and data-handling risk because users may unintentionally submit sensitive images, URLs, or queries to a third party.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README states that Telegram images are automatically saved to a local directory, but it does not clearly warn users about the privacy and data-retention implications of storing potentially sensitive user images on disk. In an image-analysis skill, users may reasonably assume transient processing, so undocumented local persistence increases the risk of unintended exposure through shared accounts, backups, or weak filesystem permissions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The guide recommends piping a remotely fetched script directly into the shell, which removes the user's opportunity to inspect the script before execution and creates a supply-chain execution path if the remote host, transport, or published installer is compromised. In a setup document for developer tooling, this is especially risky because readers are likely to run the command verbatim on their workstation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The setup guide instructs users to export an API key and append it directly into a shell profile without warning about risks such as plaintext credential persistence, accidental disclosure through dotfile syncing/backups, or exposure to other local users/processes. While common in developer docs, omitting safer handling guidance can lead to credential leakage and long-lived compromise of the associated MiniMax account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The troubleshooting guide instructs users to modify shell startup files and execute a remote installer without any warning about persistence or system impact. While common in developer docs, these actions can permanently alter a user's environment and increase the chance of unsafe copy-paste execution, especially when paired with network-fetched scripts.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 65% confidence

Finding

uvx/uv tool run commands without ==version create a rug-pull risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 65% confidence

Finding

uvx/uv tool run commands without ==version create a rug-pull risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/troubleshooting.md (reported line 29)May include surrounding context.

Check network and API key:

bash

curl -H "Authorization: Bearer $MINIMAX_API_KEY" https://api.minimaxi.com/v1/models

Webchat images don't work

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 65% confidence

Finding

uvx/uv tool run commands without ==version create a rug-pull risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 65% confidence

Finding

uvx/uv tool run commands without ==version create a rug-pull risk.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/test.py (reported line 15)May include surrounding context.

python

def check_uvx():
    """Check if uvx is installed."""
    print("1. Checking uvx installation...")
    result = subprocess.run(['which', 'uvx'], capture_output=True, text=True)
    if result.returncode == 0:
        print(f"   ✓ uvx found at: {result.stdout.strip()}")
        return True

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 65% confidence

Finding

uvx/uv tool run commands without ==version create a rug-pull risk.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/test.py (reported line 60)May include surrounding context.

python

for script in scripts:
        path = os.path.join(script_dir, script)
        if os.path.exists(path):
            result = subprocess.run(['python3', '-m', 'py_compile', path], 
                                   capture_output=True, text=True)
            if result.returncode == 0:
                print(f"   ✓ {script} is valid Python")

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill executes an MCP server via uvx without pinning an exact package version or trusted source, which can cause different code to be fetched and run over time. Because the launched tool receives the API key in its environment and handles attacker-influenced inputs, a compromised or substituted package could exfiltrate credentials or execute arbitrary behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The manifest describes a skill for analyzing images and searching the web using MiniMax MCP tools. While web search itself is in-scope, directly reading credentials from environment variables is a separate sensitive capability that is not stated in the manifest and is not inherent from the user-facing purpose alone.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/understand_image.py (reported line 41)May include surrounding context.

python

]

    try:
        proc = subprocess.Popen(
            ['uvx', 'minimax-coding-plan-mcp'],
            stdin=subprocess.PIPE, stdout=subprocess.PIPE,
            stderr=subprocess.PIPE, env=env, text=True

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/web_search.py (reported line 40)May include surrounding context.

python

]

    try:
        proc = subprocess.Popen(
            ['uvx', 'minimax-coding-plan-mcp'],
            stdin=subprocess.PIPE, stdout=subprocess.PIPE,
            stderr=subprocess.PIPE, env=env, text=True

Tainted flow: 'env' from os.environ.get (line 23, credential/environment) → subprocess.Popen (code execution)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/understand_image.py (reported line 41)May include surrounding context.

python

]

    try:
        proc = subprocess.Popen(
            ['uvx', 'minimax-coding-plan-mcp'],
            stdin=subprocess.PIPE, stdout=subprocess.PIPE,
            stderr=subprocess.PIPE, env=env, text=True

Tainted flow: 'env' from os.environ.get (line 23, credential/environment) → subprocess.Popen (code execution)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/web_search.py (reported line 40)May include surrounding context.

python

]

    try:
        proc = subprocess.Popen(
            ['uvx', 'minimax-coding-plan-mcp'],
            stdin=subprocess.PIPE, stdout=subprocess.PIPE,
            stderr=subprocess.PIPE, env=env, text=True