ClawHub
Back to skill

Security audit

MiniMax MCP Tools

Security checks across malware telemetry and agentic risk

Overview

This is a coherent MiniMax MCP setup guide whose main risks are expected third-party processing, API-key handling, and trusting an external MCP package.

Install only if you trust MiniMax and the minimax-coding-plan-mcp package. Treat MINIMAX_API_KEY as a secret, keep ~/.openclaw/mcp.json private, and avoid sending confidential searches, private images, or sensitive local file paths unless you intend them to be processed by MiniMax.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill advertises web search and image understanding features that inherently send user-supplied queries, image URLs, and potentially local file references to a third-party MiniMax service, but it does not clearly disclose that data leaves the local environment. This can mislead users into sharing sensitive prompts or local-path information without informed consent, especially in an agent workflow where tool invocation may feel seamless.

Missing User Warnings

Low
Confidence
84% confidence
Finding
The instructions tell users to place MINIMAX_API_KEY directly into a local configuration file without any warning that this is a sensitive secret. That increases the chance the key will be stored insecurely, committed to source control, shared in screenshots, or exposed to other local users/processes depending on file permissions.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal