Claude Code MiniMax 配置

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:03 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent MiniMax setup guide, but it asks users to persist API keys in Claude/VS Code configuration and includes unsafe troubleshooting commands that can expose or delete agent configuration.

Review before installing. If you use this guide, prefer a credential manager or short-lived environment variable over saving API keys in shared config, do not paste real API keys directly into shell commands, avoid printing full Claude settings files, back up configuration before changing it, and verify any third-party installer source and version before installing cc-switch.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:39

Finding

Unpinned Third-Party Tool Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39-43
Vulnerability Type: Unverified third-party dependency installation
Risk Level: Medium

bash

brew tap farion1231/ccswitch
brew install --cask cc-switch

# Windows download source:
# https://github.com/farion1231/cc-switch/releases

Technical Analysis

The guide recommends installing cc-switch from a third-party Homebrew tap or downloading a release artifact from a GitHub repository. It does not pin a reviewed version or commit and does not provide a cryptographic checksum, signature, or other integrity-verification procedure.

Homebrew tap definitions and release artifacts can change after this Skill has been reviewed. If the upstream account, repository, release process, or package definition is compromised, the installation instructions could cause users to install attacker-controlled code. This is classified as an insecure dependency rather than direct remote payload execution because the Skill uses conventional package and release distribution channels, but does so without adequate provenance or integrity controls.

Attack Path

1. An attacker compromises the third-party repository, maintainer account, release pipeline, or Homebrew tap.
2. The attacker modifies the cask definition or publishes a malicious release artifact.
3. A user follows the Skill's recommended installation instructions.
4. Homebrew or the user downloads the mutable, compromised artifact.
5. The malicious package executes during installation or when cc-switch is launched.
6. The payload operates with the privileges of the installing user and may access files, development credentials, API configuration, and other resources available to that account.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. The accessible scope could include source repositories, SSH credentials, API tokens, C ...[truncated 367 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a specific reviewed release and, where supported, an immutable commit or artifact identifier.
2. Publish the expected SHA-256 checksum for each supported platform and instruct users to verify it before installation.
3. Prefer signed release artifacts and document signature verification using a trusted maintainer key.
4. Identify the official distribution source and avoid presenting mutable third-party taps as the default installation path.
5. Document the minimum permissions required by cc-switch and advise users not to run it with administrator privileges unless strictly necessary.
6. Consider making the manual MiniMax configuration method the recommended option because it does not require installing an additional executable.
7. Periodically review pinned artifacts and update them only after validating provenance, integrity, and behavior.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:348

Finding

API Key May Be Exposed Through Shell History and Process Inspection

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 348
Vulnerability Type: Sensitive credential passed directly as a command-line argument
Risk Level: Medium

bash

curl -H "Authorization: Bearer YOUR_API_KEY" https://api.minimaxi.com/anthropic/v1/models

Technical Analysis

The troubleshooting command directs users to replace the placeholder with an actual MiniMax API key directly on the command line. This can persist the secret in shell history, terminal transcripts, synchronized history services, diagnostic logs, screenshots, or support bundles.

On systems where process arguments are visible to other local users or monitoring software, the API key may also be exposed while curl is running. Although the execution window may be short, command history commonly preserves the credential until it is explicitly removed.

The guide elsewhere warns users not to commit API keys, but that warning does not mitigate exposure caused by placing a key directly in a command-line argument.

Attack Path

1. A user replaces YOUR_API_KEY with a valid MiniMax API key and executes the command.
2. The shell records the complete command in its history, or a terminal, monitoring agent, or diagnostic tool captures it.
3. A local user, malicious process, support recipient, or party with access to synchronized history reads the recorded command.
4. The attacker extracts the bearer token.
5. The attacker submits authenticated requests to the MiniMax API until the token is revoked, expires, or reaches its quota.

Impact Assessment

The exposed token could permit unauthorized API requests within the permissions and quota assigned to that MiniMax key. Potential consequences include financial charges, quota exhaustion, service disruption, and access to account-level API capabilities granted to the credential.

This issue does not by itself grant operating-system privileges. Its scope is limited to the permissions a ...[truncated 150 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not instruct users to place a real API key directly in a shell command.

2. Read the key silently and supply it through an environment variable for the shortest practical duration:

   bash

   read -r -s MINIMAX_API_KEY
   echo
   curl -H "Authorization: Bearer ${MINIMAX_API_KEY}" \
     https://api.minimaxi.com/anthropic/v1/models
   unset MINIMAX_API_KEY
   

3. Warn that environment variables may still be accessible to same-user processes or diagnostic tools and should not be retained longer than necessary.

4. Where supported, use a protected configuration file with restrictive permissions or a credential manager instead of command-line input.

5. Add instructions for removing an accidentally recorded command from shell history, while noting that synchronized histories, logs, and backups may retain copies.

6. Advise users to revoke and rotate any API key that may have been exposed.

7. Ensure troubleshooting output never prints authorization headers or token values.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

The tutorial directs modification of ~/.claude/settings.json, an agent configuration location that commonly stores authentication material and execution settings. While normal for setup documentation, this creates a risky pattern for agent skills because it normalizes direct access to sensitive config paths and may lead automated agents to handle secrets unsafely.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

方式二：手动配置（适合高级用户）

1. 编辑 ~/.claude/settings.json

bash

# 如果文件不存在则创建

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Creating and editing ~/.claude/settings.json to insert API credentials encourages storage of secrets in a sensitive agent config file. In a skill context, such instructions can be followed automatically or semi-automatically, increasing the chance of secret persistence, accidental disclosure, or unsafe reuse.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

bash

# 如果文件不存在则创建
touch ~/.claude/settings.json

添加以下内容（将 你的MINIMAX_API_KEY 替换为实际 API Key）：

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 86% confidence

Finding

Reading ~/.claude/settings.json as part of debugging is dangerous because the file likely contains API keys and other sensitive agent settings. Even though the purpose is troubleshooting, the action can expose secrets to terminal history, copied output, logs, or the model itself.

Content

Scanner excerpt · SKILL.md (reported line 345)May include surrounding context.

md

claude --verbose

# 查看当前配置
cat ~/.claude/settings.json

# 测试 API 连接
curl -H "Authorization: Bearer 你的APIKEY" https://api.minimaxi.com/anthropic/v1/models

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Reading ~/.claude/settings.json as part of debugging is dangerous because the file likely contains API keys and other sensitive agent settings. Even though the purpose is troubleshooting, the action can expose secrets to terminal history, copied output, logs, or the model itself.

Content

Scanner excerpt · SKILL.md (reported line 345)May include surrounding context.

md

claude --verbose

# 查看当前配置
cat ~/.claude/settings.json

# 测试 API 连接
curl -H "Authorization: Bearer 你的APIKEY" https://api.minimaxi.com/anthropic/v1/models

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

The instruction to run rm ~/.claude/settings.json is a destructive operation against agent configuration. Although framed as reconfiguration, a skill that tells an agent or user to delete config files can cause denial of service, loss of setup, or removal of audit-relevant state if followed blindly.

Content

Scanner excerpt · SKILL.md (reported line 354)May include surrounding context.

md

### 重新配置

如果配置出错：
1. 删除配置文件：`rm ~/.claude/settings.json`
2. 重新按教程配置

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

The skill suggests a destructive shell command, rm ~/.claude/settings.json, without protective guardrails. In an agent environment, this can be interpreted and executed as-is, leading to loss of configuration, broken tooling, and potential disruption of future safe operation.

Content

Scanner excerpt · SKILL.md (reported line 354)May include surrounding context.

md

### 重新配置

如果配置出错：
1. 删除配置文件：`rm ~/.claude/settings.json`
2. 重新按教程配置

---

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown guidance forces a specific language/locale for all users, and there is no opt-in, alternative language option, or statement that the skill is intended only for a Chinese-speaking audience. That can violate organizational language policy requirements for user choice or documented locale constraints.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

json

{
  "env": {
    "ANTHROPIC_BASE_URL": "https://api.minimaxi.com/anthropic",
    "ANTHROPIC_AUTH_TOKEN": "你的MINIMAX_API_KEY",
    "API_TIMEOUT_MS": "3000000",
    "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC": "1",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

json

{
  "env": {
    "ANTHROPIC_BASE_URL": "https://api.minimaxi.com/anthropic",
    "ANTHROPIC_AUTH_TOKEN": "你的MINIMAX_API_KEY",
    "API_TIMEOUT_MS": "3000000",
    "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC": "1",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 78% confidence

Finding

The curl example includes a bearer token in a shell command to an external endpoint. This is risky because command lines can be captured in shell history, process listings, screenshots, and logs, exposing the API key while transmitting it to a third-party service.

Content

Scanner excerpt · SKILL.md (reported line 348)May include surrounding context.

cat ~/.claude/settings.json

测试 API 连接

curl -H "Authorization: Bearer 你的APIKEY" https://api.minimaxi.com/anthropic/v1/models

text

### 重新配置

Static analysis

No suspicious patterns detected.