Security audit

MiniMax Quota Query

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently queries MiniMax quota data, but users should avoid passing API keys on the command line.

Use this only if you intend to query MiniMax Token Plan quotas. Prefer a protected environment variable or secret manager for MINIMAX_API_KEY, avoid putting the key directly in shell commands, and rotate the key if it has been pasted into logs, shell history, or shared transcripts.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/query.py:86
Finding: API Key Exposure Through Command-Line Arguments
Content: View full analysis
1: api_key = sys.argv[1] ``` The documented invocation exposes the same behavior: ```bash uv run python3 scripts/query.py ``` ### Technical Analysis The script accepts the MiniMax bearer API key as a positional command-line argument. Command-line arguments are not a protected secret-transport mechanism and may be exposed through: - Shell history files. - Process inspection utilities and process metadata. - Endpoint monitoring and command-execution telemetry. - CI/CD logs or wrapper scripts that record complete commands. - Terminal transcripts and debugging output. Transmitting the bearer token to the declared MiniMax HTTPS quota endpoint is necessary for the Skill's stated functionality. Accepting it through a command-line argument is not necessary because the script already supports the `MINIMAX_API_KEY` environment variable. Therefore, positional credential handling exceeds the minimum exposure required by the Skill. ### Attack Path 1. A user follows the documented command and supplies a valid MiniMax API key as the first argument. 2. The complete command is retained in shell history, process metadata, monitoring telemetry, or automation logs. 3. A local user, administrator, monitoring operator, or party with access to those records obtains the API key. 4. The attacker submits the stolen bearer token to MiniMax API endpoints. 5. The attacker can access functionality authorized by that key and consume the associated account quota until the credential is revoked or expires. ### Impact Assessment An attacker may obtain the privileges assigned to the exposed MiniMax API key. Depending on the server-side scope of the credential, this can include reading quot ...[truncated 389 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/query.py:28
Finding: Bearer Authorization Header Used With Unrestricted Default Redirect Handling
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill documents use of environment access and outbound network access to query a third-party API, but it does not declare any tool scope or permission boundaries. This creates an avoidable least-privilege gap: an agent may invoke the skill with broader capabilities than necessary, increasing the chance of secret exposure or unintended external requests if the skill is modified or misrouted.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest description lists trigger scenarios including “用量是多少”, which is a generic phrase that could arise in many contexts unrelated to MiniMax quotas. Because the trigger list does not provide exclusion conditions or tighter scope, the skill may activate unintentionally.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.