ClawHub
Back to skill

Security audit

minimax-media (James)

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a normal MiniMax media-generation skill, but users should understand that prompts, text, and an API key are sent to the configured MiniMax endpoint.

Install only if you are comfortable sending prompts, TTS text, and related request metadata to MiniMax or the configured MiniMax-compatible endpoint. Use a revocable API key, do not submit secrets or regulated data unless approved, and leave MINIMAX_BASE_URL unset unless you know the alternate endpoint is trusted.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Tainted flow: 'url' from os.environ.get (line 61, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
'model': 'image-01',
        'prompt': prompt
    }
    resp = requests.post(url, headers=headers, json=payload, timeout=60)
    if resp.status_code != 200:
        return {"error": f"API error {resp.status_code}: {resp.text[:200]}"}
Confidence
95% confidence
Finding
The request destination is derived from MINIMAX_BASE_URL, an environment variable that can be changed to an attacker-controlled host. Because the code always attaches the Bearer API key in the Authorization header, a poisoned base URL can exfiltrate the credential and all submitted prompts to an arbitrary server, creating an SSRF-style outbound credential leak.

Tainted flow: 'image_urls' from requests.post (line 37, network input) → requests.get (network output)

Medium
Category
Data Flow
Content
return {"error": "No image URL returned"}
    
    # 下載圖片
    img_resp = requests.get(image_urls[0], timeout=60)
    if img_resp.status_code != 200:
        return {"error": f"Failed to download image: {img_resp.status_code}"}
Confidence
89% confidence
Finding
The code fetches image_urls[0] from the API response without validating the scheme, host, or address range. If the upstream API or a substituted base URL returns a malicious URL, the tool can be induced to make arbitrary outbound requests, potentially reaching internal services or downloading unexpected content.

Tainted flow: 'url' from os.environ.get (line 61, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
},
        'language_boost': 'auto'
    }
    resp = requests.post(url, headers=headers, json=payload, timeout=60)
    if resp.status_code != 200:
        return {"error": f"HTTP error {resp.status_code}: {resp.text[:200]}"}
Confidence
95% confidence
Finding
As with image generation, the TTS endpoint is built from MINIMAX_BASE_URL and used with the Authorization Bearer token. If that environment variable is attacker-controlled, the API key and all submitted text can be sent to a malicious server, causing credential compromise and data exfiltration.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The README documents image generation and text-to-speech usage but does not warn users that their prompts and TTS input text are transmitted to the external MiniMax API service. This can lead users to unknowingly send sensitive, proprietary, or personal data to a third party, which is a real privacy and compliance risk, especially in enterprise or regulated environments.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill describes image generation and TTS features but omits a clear disclosure that user prompts/text and authentication material are used with an external MiniMax API. This can lead users to submit sensitive content under the false impression processing is local, increasing the risk of unintended data disclosure to a third party.

Static analysis

No suspicious patterns detected.