Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent MiniMax API wrapper for web search and image understanding, with expected external API and local-image upload behavior that users should understand before use.
Install only if you are comfortable sending search queries, prompts, image URLs, and any selected local image files to MiniMax using your API key. Avoid using sensitive, regulated, or confidential images or prompts unless that external transmission is acceptable for your use case.
The skill declares access to a sensitive environment variable (MINIMAX_API_KEY) but does not explicitly declare tool scope or permissions boundaries. This can mislead users and reviewers about what the skill can access, reducing transparency and making unintended secret exposure or unauthorized external API usage harder to detect.
The skill advertises web search and image understanding, including local file support, but does not warn that search queries, image contents, and potentially local file data are transmitted to the external MiniMax API. This creates a meaningful privacy and data-handling risk because users may provide sensitive prompts or images without realizing they leave the local environment.
The image analysis path accepts a local file path, reads the file, base64-encodes its contents, and sends it to a remote MiniMax API as image_url data. This creates a real data exfiltration risk because a user or calling agent may believe they are only analyzing a local image, while the tool silently transmits the full file contents off-host without an explicit warning or consent step.
