Minimax Video
PendingStatic analysis audit pending.
Overview
No static analysis result has been recorded yet. Pattern checks will appear here once the artifact has been analyzed.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A user may install or invoke the skill expecting web search, while bundled code is set up for a different service and task.
The user-facing instructions claim a Zhipu web-search purpose and endpoint, but the bundled script calls a different provider and capability. This mismatch can mislead users about what the skill actually does.
Use Zhipu's web search API to search the internet. ... Official: `https://open.bigmodel.cn/api/paas/v4/chat/completions`
Do not use this skill until the description, documentation, credential instructions, and script all match the same provider and capability.
User prompts may be sent to an unexpected API and may trigger video-generation behavior or costs instead of returning search results.
The helper script performs MiniMax video generation and extracts a video URL, which does not match the declared Zhipu web-search workflow.
model: "video-01" ... curl ... "https://api.minimax.chat/v1/video_generation" ... VIDEO_URL=$(echo "$RESULT" | jq -r '.data.video_url // empty'
Remove or replace the script, or clearly rename and document the skill as MiniMax video generation with explicit user approval for generation requests.
A user could provide a credential for one provider and have it sent to a different provider endpoint.
The script sends the configured API key to MiniMax, while the documentation describes Zhipu web search and points users to a BigModel/Zhipu API-key page. That creates an unclear and potentially wrong credential boundary.
KEY="$MINIMAX_API_KEY" ... -H "Authorization: Bearer $KEY" ... "https://api.minimax.chat/v1/video_generation"
Declare the required credential in registry metadata, use provider-specific environment variable names, and ensure the API endpoint matches the documented key source.