MiniMax MCP Search

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:37 AM UTC
• Version: 1.0.0

Overview

The skill appears purpose-aligned for MiniMax web search and image understanding, but its implementation allows command injection through user inputs and uses an unpinned global dependency.

Review before installing. Do not use this skill with untrusted queries, prompts, or image paths until shell=True is removed and mcporter is invoked with argument arrays. Avoid submitting sensitive searches, local files, internal URLs, screenshots, or regulated data unless the external MiniMax data flow is acceptable. Prefer a pinned, local mcporter dependency over the documented global npm install.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: search.py:12

Finding

Shell Command Injection Through User-Controlled Arguments

Content

View full analysis

Vulnerability Details

File Location: search.py:12-18, search.py:25, and search.py:60
Vulnerability Type: OS command injection through unsafe shell command construction
Risk Level: High

Vulnerable Code

python

def run_mcporter(command):
    """执行 mcporter 命令"""
    result = subprocess.run(
        command,
        shell=True,
        capture_output=True,
        text=True,
        timeout=60
    )
    return result.stdout, result.stderr, result.returncode

python

cmd = f'mcporter call minimax.web_search query:"{query}"'
stdout, stderr, code = run_mcporter(cmd)

python

cmd = f'mcporter call minimax.understand_image prompt:"{prompt}" image_source:"{image_source}"'
stdout, stderr, code = run_mcporter(cmd)

Technical Analysis

The query, prompt, and image_path values originate from command-line arguments and are interpolated directly into shell command strings. The resulting strings are executed with shell=True.

Double quotes around the interpolated values do not provide effective shell escaping. An attacker can inject quotation marks, command substitutions, or other shell syntax to escape the intended argument context. The shell will interpret the injected syntax before invoking mcporter.

The issue affects both exposed operations:

• web_search interpolates the attacker-controlled query.
• understand_image interpolates the attacker-controlled prompt and image_path. Converting a local path to an absolute path does not neutralize shell metacharacters.

Attack Path

1. An attacker supplies a crafted value through --query, --prompt, or --image.
2. The application inserts the value into a command string without shell-safe escaping.
3. run_mcporter() passes that string to subprocess.run() with shell=True.
4. The operating-system shell parses the attacker-controlled syntax.
5. The injected command executes with the ...[truncated 958 chars]

Remediation

View remediation

Remediation Suggestions

Eliminate shell interpretation and pass each command argument as a separate list element:

python

def run_mcporter(command):
    return subprocess.run(
        command,
        shell=False,
        capture_output=True,
        text=True,
        timeout=60,
        check=False
    )

result = run_mcporter([
    "mcporter",
    "call",
    "minimax.web_search",
    f"query:{query}",
])

Apply the same approach to image analysis:

python

result = run_mcporter([
    "mcporter",
    "call",
    "minimax.understand_image",
    f"prompt:{prompt}",
    f"image_source:{image_source}",
])

Additional hardening should include:

• Do not attempt to retain shell=True through manual escaping; argument-array execution is safer.
• Validate image URLs against an explicit allowlist of accepted schemes such as https.
• Define appropriate length limits for queries, prompts, URLs, and paths.
• Validate local image paths against an approved directory if callers must not access arbitrary local files.
• Resolve the executable using a trusted, fixed path where deployment permits, reducing path-based executable substitution risks.
• Return controlled error messages rather than exposing arbitrary subprocess diagnostic output to untrusted callers.

T08 · Insecure Dependencies

Warning

• Location: _meta.json:9

Finding

Unpinned Global Installation of a Third-Party Executable

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:42 and _meta.json:9-15
Vulnerability Type: Unpinned third-party dependency and mutable global installation
Risk Level: Medium

Vulnerable Code

SKILL.md:42:

text

- 需要先安装 mcporter：`npm install -g mcporter`

_meta.json:9-15:

json

"install": [
  {
    "id": "node",
    "kind": "node",
    "package": "mcporter",
    "bins": ["mcporter"]
  }
]

Technical Analysis

Both the documented installation command and package metadata request mcporter without an exact version or integrity constraint. Package resolution can therefore select a newer, mutable release than the one reviewed or tested with this project.

The documentation also recommends a global npm installation. npm packages can contain lifecycle scripts that execute during installation, and a global installation makes the resulting executable available broadly through the user's command search path. Consequently, a malicious future release, compromised publisher account, or registry-side supply-chain incident could change the executable behavior without any modification to this repository.

There is no evidence in the reviewed files that mcporter is currently malicious. The finding concerns the unsafe dependency acquisition and installation model.

Attack Path

1. A user or automated installer processes the project installation instructions or metadata.
2. npm resolves the unversioned mcporter dependency to the package version currently selected by the registry.
3. If that release or its dependency chain has been compromised, package installation or lifecycle code executes locally.
4. The compromised package installs or exposes a malicious mcporter executable.
5. When search.py invokes mcporter, the attacker-controlled executable runs with the skill process's privileges.

Impact Assessment

A compromised dependency could execute code during ...[truncated 720 chars]

Remediation

View remediation

Remediation Suggestions

• Pin mcporter to an exact, reviewed version in both installation metadata and documentation.
• Use a project-local dependency rather than recommending global installation.
• Maintain a lockfile with package integrity hashes and commit it to the project.
• Install with a reproducible command such as npm ci in controlled deployments.
• Verify the package name, publisher, provenance, and official registry source before installation.
• Review dependency lifecycle scripts and disable them during installation where they are unnecessary.
• Run the dependency with least privilege in an isolated environment.
• Establish an update process in which new versions are reviewed and tested before changing the pin.
• Ensure search.py invokes the expected project-local executable rather than whichever mcporter binary appears first in the ambient PATH.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

This is the same core issue as AST4 but viewed through tool-parameter abuse: untrusted parameters are embedded into a shell command and executed with shell=True. Because query, prompt, and image_source are attacker-influenced, a crafted input can break out of quoting and run arbitrary commands on the host, which is especially dangerous in an agent skill that may process remote or user-supplied input.

Content

Scanner excerpt · search.py (reported line 14)May include surrounding context.

python

def run_mcporter(command):
    """执行 mcporter 命令"""
    result = subprocess.run(
        command,
        shell=True,
        capture_output=True,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

A language-specific skill description can violate language or locale policy when it effectively forces a single language without user opt-in or explanation. This file presents all operational guidance in Chinese and does not mention that other languages are supported or that the restriction is intentional for a region-specific audience.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly supports sending either local image files or remote image URLs to an external MiniMax service, but it does not warn users that image contents or fetched URL data will leave the local environment. This creates a real privacy and data-handling risk because users may unknowingly submit sensitive local images, internal screenshots, or intranet-hosted content to a third party.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The module docstring and CLI description label this as a "MiniMax MCP Search Skill," which implies a search-focused capability. However, the code also exposes an understand_image tool that analyzes images from either local filesystem paths or remote URLs, which is a materially different capability than search.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Natural-language strings throughout the file, including the module description, error messages, and default image prompt, are hard-coded in Chinese. The file does not offer any opt-in, locale selection, or justification for restricting interaction to a specific language.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 99% confidence

Finding

The helper executes a constructed command string via subprocess.run(..., shell=True). Because both web_search() and understand_image() interpolate user-controlled values into that string, an attacker can inject shell metacharacters and execute arbitrary OS commands, making this a real command-injection vulnerability.

Content

Scanner excerpt · search.py (reported line 14)May include surrounding context.

python

def run_mcporter(command):
    """执行 mcporter 命令"""
    result = subprocess.run(
        command,
        shell=True,
        capture_output=True,

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

With no manifest available, the only stated intent comes from the code documentation and CLI description, both of which describe a search skill. Adding image analysis over local paths and URLs expands the skill into multimodal content inspection, which is not justified by the stated search-oriented purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill forwards local file paths or remote image URLs to an external MCP tool without warning or consent messaging. In this context, that can expose sensitive local files or cause unintended transmission of private data to an external service, especially because the feature accepts arbitrary local paths.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description is written entirely in Chinese and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the policy, language or locale constraints should be opt-in or clearly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill advertises real-time web search through MiniMax MCP but does not tell users that their search queries will be transmitted to an external provider. While lower impact than file exfiltration, search terms can still contain sensitive business topics, internal project names, or personal data, so the missing disclosure is a genuine privacy weakness.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest description is written only in Chinese ("使用 MiniMax MCP 进行网络搜索和图像理解"), which can be interpreted as a language-specific constraint in the skill's user-facing natural language. There is no indication that the skill supports multiple languages, offers user opt-in, or is region-specific, so this may violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.