ClawHub
Back to skill

Security audit

minimax-mcp-docker版（适配极空间）

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent MiniMax image/search purpose, but it handles API keys and executable tooling in ways that need human review before installation.

Review this skill before installing. Do not paste a real API key into chat; configure secrets yourself using a trusted local mechanism, prefer a narrowly scoped/rotatable MiniMax key, and avoid running the wrapper from untrusted project directories unless the MCP executable path is fixed and the dependency version is pinned.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T07 · Tool Hijacking and Spoofing

Error
Location
minimax_mcp.py:12
Finding

Relative MCP Path Enables Credential-Bearing Tool Hijacking

Content
View full analysis

Vulnerability Details

File Location: minimax_mcp.py, lines 12-58
Vulnerability Type: Local dependency path hijacking
Risk Level: High

Vulnerable Code

python
MCP_PATH = "node_modules/@ameno/pi-minimax-mcp/bin/pi-minimax-mcp.js"

def run_mcp_command(command, args):
    """Run MiniMax MCP command"""

    api_key = get_api_key()
    if not api_key:
        return "Error: No API key found. Set MINIMAX_API_KEY or create ~/.openclaw/credentials/minimax.json"

    # Build command
    cmd = ['node', MCP_PATH, command] + args

    # Set environment
    env = os.environ.copy()
    env['MINIMAX_API_KEY'] = api_key
    env['MINIMAX_API_HOST'] = DEFAULT_API_HOST

    # Run
    try:
        result = subprocess.run(
            cmd,
            capture_output=True,
            text=True,
            env=env,
            timeout=120
        )

Technical Analysis

MCP_PATH is a relative path resolved from the process's current working directory. The documentation instructs users to install the MCP package globally, but the implementation does not resolve or invoke a trusted global installation. Instead, it executes any JavaScript file present at the expected relative node_modules path.

Before execution, the wrapper reads the MiniMax API key and places it in the child process environment. Consequently, a spoofed JavaScript file receives both arbitrary code execution in the user's security context and direct access to MINIMAX_API_KEY.

Passing cmd as an argument list without shell=True prevents conventional shell metacharacter injection through command or args, but it does not mitigate executable path substitution.

Attack Path

  1. An attacker gains the ability to create files in a directory from which the user may invoke the wrapper, such as an untrusted downloaded project.
  2. The attacker creates: node_modules/@ameno/pi-minimax-mcp/bin/pi-minimax-mcp.js. ...[truncated 1009 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not resolve security-sensitive executables relative to the current working directory.
  2. Install the dependency in a controlled, project-local environment and resolve it from the wrapper's own directory using an absolute canonical path.
  3. Pin the exact reviewed package version and verify its integrity before execution.
  4. Confirm that the resolved script is a regular file inside the expected installation directory and reject symlinks or paths under untrusted writable projects.
  5. Consider invoking a verified package entry point rather than constructing a path into node_modules.
  6. Minimize the child environment instead of copying all of os.environ; provide only variables required by the MCP process.
  7. Where supported, use a narrowly scoped token and rotate the existing key if the wrapper has been run from untrusted directories.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Unpinned Globally Installed npm Dependency Creates Supply-Chain Exposure

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 14; repeated at line 83
Vulnerability Type: Mutable and globally installed third-party dependency
Risk Level: Medium

Vulnerable Code

bash
npm install -g @ameno/pi-minimax-mcp

Technical Analysis

The installation command does not specify an exact package version or integrity digest. It therefore installs whichever release is associated with the package's current npm distribution tag at installation time. That code may differ from the release reviewed when the Skill was audited.

The package is installed globally and is expected to process user images, search queries, and a MiniMax API credential. Global installation unnecessarily expands the package's execution and modification scope and makes reproducible dependency review more difficult.

No evidence establishes that the named package is currently malicious. The confirmed issue is that the installation process trusts a mutable third-party package release without version or integrity controls.

Attack Path

  1. The npm package, publisher account, distribution tag, or release process is compromised, or a future release introduces malicious behavior.
  2. A user follows the Skill instructions and installs the package without a version pin.
  3. npm retrieves the mutable latest release rather than a previously audited artifact.
  4. The Skill executes the installed component while providing sensitive images, queries, and the MiniMax API key.
  5. The compromised package can steal those values or execute code with the user's privileges.

Impact Assessment

A malicious dependency release could execute arbitrary code as the installing or invoking user. It could steal the MiniMax credential, inspect user-accessible files, transmit image content and search queries to unauthorized services, or manipulate returned results.

The exact installation-time impact also depends on the privileges used for ...[truncated 175 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to an exact audited version rather than relying on a mutable distribution tag.
  2. Record and verify the package integrity hash through a committed lockfile.
  3. Prefer a project-local installation over a global installation.
  4. Review the package's source, maintainers, lifecycle scripts, transitive dependencies, and published artifact.
  5. Disable npm lifecycle scripts during installation unless they are required and have been audited.
  6. Run the MCP component with the minimum filesystem and network privileges needed for MiniMax requests.
  7. Establish an update process that repeats security review before changing the pinned version.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:87
Finding

Skill Instructions Solicit an API Key Through the Agent Conversation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 87-110
Vulnerability Type: Insecure secret collection and plaintext credential handling
Risk Level: Medium

Vulnerable Instruction

The following is an English translation of the complete credential-handling instruction in the source:

text
If the credential file does not exist or the API key cannot be read:

1. Automatically remind the user that a MiniMax API key is required.
2. Direct the user to the MiniMax platform to obtain a key.
3. After the user provides the key, help the user create the configuration
   file in the correct location.

Example:
Agent: No MiniMax API key configuration was found. Please provide your API
       key to use image understanding.
User: sk-xxxxxxxxxxxxx
Agent: Okay, configuring your API key...
       Configuration completed.

Technical Analysis

The Skill directs the Agent to request the API key in an ordinary conversation and then write it to a local credential file. Although the target file is documented with restrictive permissions, the secret first passes through the chat channel.

Conversation histories, model-provider processing, application telemetry, debugging logs, browser state, and Agent transcripts may retain chat messages. File permissions on the final credential file do not protect copies created earlier in those systems.

Soliciting the key through chat is unnecessary for the declared functionality. The user can configure it through a local masked prompt, an environment variable, or a secret-management interface without disclosing it to the conversation.

Attack Path

  1. The credential file is missing or unreadable.
  2. Following the Skill instructions, the Agent asks the user to provide the MiniMax API key in chat.
  3. The user posts the plaintext key as a message.
  4. The message may be retained in chat history, logs, telemetry, backups, or provider-side processing records.

...[truncated 635 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove all instructions telling the Agent to request or accept API keys through chat.
  2. Direct users to configure the key locally using a masked terminal prompt, operating-system credential store, or approved secret manager.
  3. If a file must be used, create it with restrictive permissions before writing and avoid shell commands that expose the secret in shell history or process arguments.
  4. Prefer MINIMAX_API_KEY injection through a trusted runtime secret facility.
  5. Warn users not to paste credentials into conversations and provide a key-rotation procedure for accidental disclosure.
  6. Add redaction controls for values matching expected MiniMax key formats in application logs and diagnostics.
  7. Use narrowly scoped and revocable credentials where MiniMax supports them.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (13)

Ssd 3

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill directly instructs the agent to ask the user for an API key in chat and then persist it locally. This is high risk because conversational channels are not appropriate secret-entry mechanisms, and the agent becomes a sink for credential collection and storage, increasing the chance of leakage, logging exposure, or unauthorized reuse.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · minimax_mcp.py (reported line 45)May include surrounding context.

python
cmd = ['node', MCP_PATH, command] + args
    
    # Set environment
    env = os.environ.copy()
    env['MINIMAX_API_KEY'] = api_key
    env['MINIMAX_API_HOST'] = DEFAULT_API_HOST

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The entire skill description and example interactions are written only in Chinese, and the examples assume Chinese-language prompts without indicating that other languages are supported or that Chinese is a region-specific requirement. This can constitute a language/locale policy issue when no user opt-in or justification is provided.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill advertises image understanding and web search but does not clearly warn that uploaded images and search queries may be transmitted to an external MiniMax service. This can lead users to share sensitive images or queries without informed consent about third-party processing.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The document claims API keys are not in code, but later instructs the agent to request the key in chat and persist it locally. That inconsistency can mislead users into believing secret handling is safer than it is, while normalizing transmission of sensitive credentials through an insecure conversational channel.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

This duplicated finding points to the same behavior: creating a credential directory and writing secrets into it for future sessions. The danger is durable storage of sensitive authentication material in a predictable filesystem location, which broadens the blast radius of local compromise.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

bash
# 1. 创建目录
mkdir -p ~/.openclaw/credentials

# 2. 保存 API Key（替换为你的 key）
echo '{"api_key": "sk-cp-xxx", "api_host": "https://api.minimaxi.com"}' > ~/.openclaw/credentials/minimax.json

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

This duplicated finding points to the same behavior: creating a credential directory and writing secrets into it for future sessions. The danger is durable storage of sensitive authentication material in a predictable filesystem location, which broadens the blast radius of local compromise.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

bash
# 1. 创建目录
mkdir -p ~/.openclaw/credentials

# 2. 保存 API Key(替换为你的 key)
echo '{"api_key": "sk-cp-xxx", "api_host": "https://api.minimaxi.com"}' > ~/.openclaw/credentials/minimax.json

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

echo '{"api_key": "sk-cp-xxx", "api_host": "https://api.minimaxi.com"}' > ~/.openclaw/credentials/minimax.json

3. 设置权限

chmod 600 ~/.openclaw/credentials/minimax.json

text

## 我是如何自动调用的

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly tells the agent to accept an API key from chat and write it into a local credential file, which expands the agent's capabilities from image/search handling into sensitive local file creation. This is dangerous because secrets provided conversationally may be mishandled, persisted without adequate consent controls, and create a lasting credential footprint on disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill describes automatic writing of a user-provided API key to disk without warning about the security and privacy implications of local secret persistence. Users may disclose credentials without understanding retention, filesystem exposure, backup propagation, or multi-user host risks.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · minimax_mcp.py (reported line 39)May include surrounding context.

python
api_key = get_api_key()
    if not api_key:
        return "Error: No API key found. Set MINIMAX_API_KEY or create ~/.openclaw/credentials/minimax.json"
    
    # Build command
    cmd = ['node', MCP_PATH, command] + args

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · minimax_mcp.py (reported line 51)May include surrounding context.

python
# Run
    try:
        result = subprocess.run(
            cmd,
            capture_output=True,
            text=True,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The understand_image function sends a user-specified local file to an external MiniMax service, but the interface does not provide an explicit user-facing consent or disclosure at the point of transmission. In an agent skill context, this can cause unintended exfiltration of sensitive local images, screenshots, or documents if the caller does not realize the file content leaves the host.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:69