Claude Code MiniMax 配置

Security checks across static analysis, malware telemetry, and agentic risk

Overview

This is a coherent configuration guide for using MiniMax with Claude Code, with no hidden code or malicious behavior evidenced, but it does involve API-key handling, third-party installation guidance, and Claude Code file/command authority.

Before installing or following this skill, make sure you are comfortable routing Claude Code traffic to MiniMax, storing a MiniMax API key in local configuration files, and optionally installing cc-switch from its external source. Only trust project folders you control, review Claude Code’s proposed changes, and avoid sending secrets or sensitive code unless your organization permits it.

Static analysis

No static analysis findings were reported for this release.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#ASI02: Tool Misuse and Exploitation

Medium

What this means

If the user runs Claude Code in a trusted project, it may read or change files and execute development commands.

Why it was flagged

The guide accurately discloses that Claude Code can modify files and run commands, which is central to the stated AI coding-assistant purpose but is still high-impact authority.

Skill content

Claude Code 可以：
- 读写代码、创建/修改文件
- 执行命令、运行测试

Recommendation

Use it only in projects you trust, review proposed file changes and command executions, and keep backups or version control enabled.

#ASI03: Identity and Privilege Abuse

Medium

What this means

Anyone who can read the local configuration may be able to use the MiniMax API key and consume account quota.

Why it was flagged

The guide requires a MiniMax API key and stores it in Claude Code or VS Code configuration. This is purpose-aligned, but it is sensitive account/billing access and is not declared in the registry metadata.

Skill content

"ANTHROPIC_AUTH_TOKEN": "你的MINIMAX_API_KEY"

Recommendation

Use a dedicated MiniMax key if possible, avoid committing configuration files, restrict local file permissions, and rotate the key if it is exposed.

#ASI04: Agentic Supply Chain Vulnerabilities

Low

What this means

Installing cc-switch means trusting that external project and its release channel.

Why it was flagged

The recommended easy setup path installs a third-party tool from an external Homebrew tap/GitHub source without a pinned version. This is user-directed and relevant to the setup, but it introduces normal supply-chain trust considerations.

Skill content

brew tap farion1231/ccswitch
brew install --cask cc-switch

Recommendation

Review the cc-switch project and release source before installing, prefer official documentation, and keep the tool updated from trusted sources.

#ASI07: Insecure Inter-Agent Communication

Medium

What this means

Code snippets, prompts, and task context used with Claude Code may be processed by MiniMax rather than Anthropic.

Why it was flagged

The configuration routes Claude Code’s Anthropic-compatible API traffic to MiniMax. This is the stated purpose, but prompts and code context may be sent to that provider.

Skill content

"ANTHROPIC_BASE_URL": "https://api.minimaxi.com/anthropic"

Recommendation

Confirm MiniMax’s data-handling terms and avoid sending secrets, proprietary code, or regulated data unless approved.