ClawHub
Back to skill

Security audit

国内Minimax Coding Plan订阅计划用量查询

Security checks across malware telemetry and agentic risk

Overview

The skill appears to check MiniMax usage as advertised, but it loads and executes a broader parent .env file instead of the documented local one.

Review before installing. Only run this after confirming which .env file will be sourced, and prefer changing it to read only MINIMAX_CODING_API_KEY and MINIMAX_GROUP_ID from a same-directory file or from already-set environment variables.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Credential Access

High
Category
Privilege Escalation
Content
# Usage: ./minimax-usage.sh
# Requires: MINIMAX_CODING_API_KEY and MINIMAX_GROUP_ID in .env

source "$(dirname "$0")/../../.env"

API_KEY="${MINIMAX_CODING_API_KEY}"
GROUP_ID="${MINIMAX_GROUP_ID}"
Confidence
81% confidence
Finding
.env"

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.