For using minimax mcp to generate audio, image, video to telegram.

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:52 PM UTC
• Version: 1.0.0

Overview

The skill is coherent and openly focused on generating MiniMax media and sending it to Telegram, with disclosed but real setup and signed-link handling risks.

Install only if you are comfortable running unpinned third-party npm/MCP tooling, and consider pinning or verifying mcporter and minimax-mcp first. Use a least-privileged MiniMax API key, avoid exposing signed MiniMax URLs beyond the intended Telegram delivery path, and be aware that generated media sent to Telegram is accessible to Telegram and the selected recipients.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Third-Party Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–18 and 37
Vulnerability Type: Unpinned third-party dependencies and mutable package execution
Risk Level: Medium

Vulnerable Code

bash

# If npm/npx is unavailable
npm install -g mcporter

bash

npx mcporter --help

bash

mcporter mcp add minimax-mcp

Technical Analysis

The Skill directs users to install or execute mcporter by package name without specifying an exact version, integrity hash, verified publisher, or trusted registry. The npx command may retrieve and immediately execute the package version currently served by the configured npm registry.

The Skill also adds minimax-mcp without identifying an exact reviewed version or immutable source. Consequently, the components executed during future installations may differ from those present when the Skill was audited. This creates a supply-chain trust boundary in which a compromised publisher account, malicious package update, dependency confusion condition, registry compromise, or package substitution could introduce arbitrary executable code.

The global installation form increases exposure because package installation scripts and runtime code execute with the invoking user's permissions and place software in a shared environment. The configured MiniMax credential may also be available to subsequently executed MCP components.

Attack Path

1. An attacker compromises a referenced package, its publisher account, one of its transitive dependencies, or the package-distribution channel.
2. The attacker publishes a malicious release under the mutable package name.
3. A user follows the Skill instructions and runs npm install -g mcporter, npx mcporter --help, or adds the unpinned minimax-mcp server.
4. The package manager retrieves the malicious current release because no reviewed version or integrity value is enforced.
5. Installation hooks or package ...[truncated 917 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin mcporter and the MiniMax MCP server to exact versions that have been reviewed.
2. Document the official package registry, canonical package names, expected publishers, and immutable source repositories.
3. Use lockfiles and package integrity hashes where supported, and verify downloaded artifacts before execution.
4. Prefer a project-local installation over npm install -g to reduce shared-environment exposure and improve reproducibility.
5. Avoid implicit npx downloads. Use npx --no-install with a previously verified local dependency or invoke the pinned local binary directly.
6. Disable or strictly control package installation scripts where feasible.
7. Run MCP components under a dedicated, least-privileged account or sandbox with restricted filesystem and network access.
8. Expose MINIMAX_API_KEY only to the process that requires it, rotate it periodically, and ensure it is not written to logs.
9. Establish a dependency-update review process that checks provenance, signatures, integrity values, release changes, and transitive dependencies before changing pinned versions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

name: minimax-to-telegram
description: |
  Generate images, audio, video using MiniMax MCP and send to Telegram. 
  Use when user wants to create media with MiniMax and deliver it via Telegram.
---

# Setup (Prerequisites)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

name: minimax-to-telegram
description: |
  Generate images, audio, video using MiniMax MCP and send to Telegram. 
  Use when user wants to create media with MiniMax and deliver it via Telegram.
---

# Setup (Prerequisites)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The skill tells users to install and invoke mcporter via npm/npx without pinning an exact version or verifying integrity. This creates a supply-chain risk because a later compromised or malicious package release could be fetched and executed in the user's environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

Using npx mcporter without an explicit pinned version can cause execution of whatever package version is currently resolved from the registry. If the upstream package is replaced, hijacked, or unexpectedly changed, the skill workflow could run untrusted code.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly instructs users to forward full MiniMax URLs including query-string authentication tokens to Telegram. Those signed URLs are bearer secrets; exposing them to Telegram, logs, chat history, previews, or unintended recipients can leak access to generated media until expiry and may broaden access beyond the intended user.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The document uses prescriptive language such as 'Always include this when generating Cantonese audio' and 'Always add' specific languageBoost values. This imposes a locale/language configuration rather than presenting it as an optional or user-selected setting.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.