MiniMax Provider 配置

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:19 PM UTC
• Version: 2.0.0

Overview

The skill mostly does what it says, but its install and configuration guidance includes risky unpinned downloads and live OpenClaw config changes that users should review before using.

Install from a trusted ClawHub release when possible. Avoid the README's mutable GitHub main-branch download unless you pin and verify the exact archive first, back up ~/.openclaw/openclaw.json before edits, confirm any API key or OAuth setup, and treat any recurring quota-check cron as a deliberate billed API call.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:42

Finding

Unpinned Remote Skill Retrieval from a Mutable Branch

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 42-45
Vulnerability Type: Remote retrieval of mutable Skill content
Risk Level: High

Vulnerable Code

bash

# Download and extract into the skills directory
cd ~/.openclaw/workspace/skills
curl -L https://github.com/jooey/openclaw-skill-add-minimax-provider/archive/refs/heads/main.tar.gz | tar xz
mv openclaw-skill-add-minimax-provider-main add-minimax-provider

Technical Analysis

The installation command retrieves the current contents of the mutable main branch from a personal GitHub repository and pipes the response directly into tar. It does not pin a reviewed commit or release, verify a checksum or signature, inspect the archive, or stage the files in an isolated location before placing them in OpenClaw's automatically loaded Skill directory.

Although the audited repository currently contains only Markdown documentation and no executable scripts, the remote branch can change after this audit. Future archive contents could include modified Skill instructions or additional scripts that were not present during review. Once installed, OpenClaw is instructed to recognize and load the Skill in a new session, giving subsequently retrieved instructions an execution channel through the Agent.

The command also fails to use options such as curl --fail, meaning an unexpected HTTP response may be passed to the extractor. No malicious content was present in the reviewed artifact, but the installation mechanism creates a time-of-review/time-of-use supply-chain gap.

Attack Path

1. An attacker compromises the GitHub account, repository, or another mechanism capable of modifying the main branch.
2. The attacker adds malicious Agent instructions or scripts to the branch.
3. A user follows the documented installation command.
4. curl retrieves the attacker-controlled current branch without verifying its identity or integrity.
5. tar e ...[truncated 934 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable branch URL with a release artifact or archive pinned to a reviewed commit hash.
2. Publish an expected SHA-256 digest through a trusted channel and verify it before extraction.
3. Use curl --fail --show-error --location so HTTP errors do not silently flow into the extractor.
4. Download the archive to a temporary directory instead of piping it directly into tar.
5. List and inspect archive contents before extraction, then copy only expected files into the Skill directory.
6. If releases are signed, verify the release signature and document the trusted signing identity.
7. Review retrieved SKILL.md instructions and any scripts before allowing OpenClaw to load the Skill.

A hardened workflow should follow this pattern:

bash

set -euo pipefail
tmp_dir="$(mktemp -d)"
trap 'rm -rf "$tmp_dir"' EXIT

curl --fail --show-error --location \
  "https://github.com/jooey/openclaw-skill-add-minimax-provider/archive/<PINNED_COMMIT>.tar.gz" \
  --output "$tmp_dir/skill.tar.gz"

echo "<EXPECTED_SHA256>  $tmp_dir/skill.tar.gz" | sha256sum --check
tar -tzf "$tmp_dir/skill.tar.gz"
tar -xzf "$tmp_dir/skill.tar.gz" -C "$tmp_dir"

The extracted content should then be reviewed before it is copied into ~/.openclaw/workspace/skills.

T08 · Insecure Dependencies

Warning

• Location: README.md:28

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 28-30
Vulnerability Type: Unpinned third-party dependency with global installation scope
Risk Level: Medium

Vulnerable Code

bash

clawhub install add-minimax-provider

text

No clawhub? Install it first: `npm i -g clawhub`

Technical Analysis

The documentation directs users to install the latest version of the clawhub npm package globally. No exact package version, lockfile, registry restriction, provenance requirement, or integrity value is supplied.

npm packages may define lifecycle scripts that execute during installation. Consequently, installing an unpinned package can execute behavior introduced by any package version selected at installation time rather than behavior tied to a version reviewed with this Skill. Global installation also broadens the package's availability and effects beyond this project's directory.

This installation is ancillary to the Skill's core purpose of configuring a MiniMax provider. A global mutable dependency is not the minimum privilege or scope required when the Skill can also be installed from verified local files.

Attack Path

1. An attacker compromises the npm package, its publisher account, or the upstream release process.
2. The attacker publishes a malicious version that becomes the version selected by npm for an unpinned installation.
3. A user runs npm i -g clawhub as documented.
4. npm downloads the selected package and its transitive dependencies.
5. Any enabled installation lifecycle scripts execute with the permissions of the invoking user.
6. The globally installed command remains available and may execute attacker-controlled behavior when subsequently used to install the Skill.

Impact Assessment

Malicious npm installation logic could obtain the privileges of the user running npm. This could permit access to that user's files, environment variables, credentials, ...[truncated 397 chars]

Remediation

View remediation

Remediation Suggestions

1. Specify an exact, reviewed package version, such as clawhub@X.Y.Z, rather than allowing npm to resolve the latest release.
2. Document the expected package integrity or provenance information and require verification before installation.
3. Prefer a project-local installation over -g where supported.
4. Use a lockfile for the package and its transitive dependency graph.
5. Disable lifecycle scripts with --ignore-scripts if ClawHub does not require them.
6. Explicitly instruct users not to run the installation with sudo or from an administrator shell.
7. Prefer installation through an already trusted ClawHub environment or provide a verified manual installation procedure.

For example, after selecting and reviewing a specific release:

bash

npm install --save-exact clawhub@X.Y.Z

If lifecycle scripts are unnecessary:

bash

npm install --save-exact --ignore-scripts clawhub@X.Y.Z

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger examples are broad, natural-language phrases like '加 MiniMax', '配 minimax', and '接入 MiniMax 模型', which are likely to appear in ordinary admin conversation and can cause the skill to auto-activate unintentionally. In a skill that changes provider configuration, aliases, and fallback chains, accidental activation can lead to unauthorized or surprising configuration changes and may expose the system to further prompt-driven actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description says to use this skill when an administrator says phrases like “加 MiniMax” or “配 minimax”, which are short, generic utterances that could appear in ordinary discussion rather than an explicit request to modify OpenClaw configuration. The trigger guidance does not define exclusions or clarify that invocation is only for provider configuration tasks in a specific context.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

1A. 测试 API Key 直连（openai-completions 协议）

bash

curl -s --max-time 15 https://api.minimaxi.com/v1/chat/completions \
  -H "Authorization: Bearer <你的API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{"model":"MiniMax-M2.1","messages":[{"role":"user","content":"hi"}],"max_tokens":10}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

1A. 测试 API Key 直连（openai-completions 协议）

bash

curl -s --max-time 15 https://api.minimaxi.com/v1/chat/completions \
  -H "Authorization: Bearer <你的API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{"model":"MiniMax-M2.1","messages":[{"role":"user","content":"hi"}],"max_tokens":10}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

1A. 测试 API Key 直连（openai-completions 协议）

bash

curl -s --max-time 15 https://api.minimaxi.com/v1/chat/completions \
  -H "Authorization: Bearer <你的API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{"model":"MiniMax-M2.1","messages":[{"role":"user","content":"hi"}],"max_tokens":10}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

1A. 测试 API Key 直连（openai-completions 协议）

bash

curl -s --max-time 15 https://api.minimaxi.com/v1/chat/completions \
  -H "Authorization: Bearer <你的API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{"model":"MiniMax-M2.1","messages":[{"role":"user","content":"hi"}],"max_tokens":10}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

1A. 测试 API Key 直连（openai-completions 协议）

bash

curl -s --max-time 15 https://api.minimaxi.com/v1/chat/completions \
  -H "Authorization: Bearer <你的API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{"model":"MiniMax-M2.1","messages":[{"role":"user","content":"hi"}],"max_tokens":10}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 347)May include surrounding context.

1A. 测试 API Key 直连（openai-completions 协议）

bash

curl -s --max-time 15 https://api.minimaxi.com/v1/chat/completions \
  -H "Authorization: Bearer <你的API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{"model":"MiniMax-M2.1","messages":[{"role":"user","content":"hi"}],"max_tokens":10}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 388)May include surrounding context.

1A. 测试 API Key 直连（openai-completions 协议）

bash

curl -s --max-time 15 https://api.minimaxi.com/v1/chat/completions \
  -H "Authorization: Bearer <你的API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{"model":"MiniMax-M2.1","messages":[{"role":"user","content":"hi"}],"max_tokens":10}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 403)May include surrounding context.

1A. 测试 API Key 直连（openai-completions 协议）

bash

curl -s --max-time 15 https://api.minimaxi.com/v1/chat/completions \
  -H "Authorization: Bearer <你的API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{"model":"MiniMax-M2.1","messages":[{"role":"user","content":"hi"}],"max_tokens":10}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs users to edit a live configuration file and later restart the Gateway, but it does not first require a backup, maintenance window, or rollback plan. In production, an incorrect edit can cause service interruption or crash-loop behavior, which the document itself acknowledges elsewhere, making this an availability risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 347)May include surrounding context.

text

# cron 表达式示例：每 5 小时执行一次验证
# 发真实请求 → 通了就可用，不通就记录
curl -s https://api.minimaxi.com/v1/chat/completions \
  -H "Authorization: Bearer <API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{"model":"MiniMax-M2.1","messages":[{"role":"user","content":"test"}],"max_tokens":3}'

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest says this skill is for configuring MiniMax as a model source in OpenClaw, covering provider registration, model definitions, aliases, fallback integration, and verification. The referral link and discount promotion are not required to perform that configuration and add a marketing capability outside the stated administrative purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.