Mini-Agent

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:49 AM UTC
• Version: 1.0.0

Overview

The skill is a disclosed coding agent, but it should be reviewed carefully because it installs mutable remote code and persistently logs detailed session contents.

Install only if you trust the upstream MiniMax-AI/Mini-Agent repository at install time. Prefer a pinned commit or reviewed release, run it in a constrained workspace, avoid using it with secrets unless logs are disabled or protected, and review destructive file or process operations before allowing them.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:10

Finding

Unpinned Remote Repository Installation Allows Mutable Code Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10-18
Vulnerability Type: Remote installation of executable code from an unpinned Git repository
Risk Level: Medium

Vulnerable Code

json

"install":
  [
    {
      "id": "node",
      "kind": "node",
      "package": "mini-agent",
      "bins": ["mini-agent"],
      "label": "Install Mini-Agent (uv)",
      "command": "uv tool install git+https://github.com/MiniMax-AI/Mini-Agent.git"
    }
  ]

The displayed label is an English translation of the original label; the installation command is reproduced exactly.

Technical Analysis

The installation command retrieves executable source code from the default branch of an external Git repository without specifying an immutable commit hash or release tag. The effective code installed by this Skill can therefore change after the Skill has been audited.

HTTPS protects the connection in transit but does not guarantee that the repository's future contents remain trustworthy. A compromised maintainer account, malicious upstream update, repository takeover, or unauthorized branch modification could cause subsequent installations to retrieve attacker-controlled code.

This is especially significant because the installed agent is documented as having file read/write access, shell execution, and process-management capabilities. The package metadata also names mini-agent while the command installs directly from Git, making conventional package-version review less reliable.

Attack Path

1. An attacker compromises the upstream repository, a maintainer account, or the repository's default branch.
2. The attacker adds malicious installation-time or runtime code to the repository.
3. A user or automated Agent executes the documented uv tool install command.
4. uv retrieves and builds the current mutable repository contents.
5. The malicious code executes during installation or when ...[truncated 801 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installation source to a reviewed, immutable full commit hash rather than the repository's default branch.
2. Prefer a versioned release distributed through a trusted package registry with integrity metadata.
3. Verify release signatures or published cryptographic checksums before installation.
4. Record the exact source repository, commit, package version, and expected artifact digest in the Skill metadata.
5. Make the declared package source consistent with the command that is actually executed.
6. Review dependency lock files and transitive dependencies associated with the pinned release.
7. Run installation and execution in a restricted environment with minimal filesystem and network access.
8. Require explicit user approval before downloading or executing a changed dependency version.

T09 · Insecure Skill Coding Practices

Warning

• Location: CONFIG.md:73

Finding

Comprehensive Agent Logs May Persist Prompts, Reasoning, and Sensitive Tool Results

Content

View full analysis

Vulnerability Details

File Location: CONFIG.md, lines 73-85
Vulnerability Type: Sensitive information exposure through verbose persistent logging
Risk Level: Medium

Vulnerable Code

The relevant documentation states, translated into English:

markdown

### Log location
~/.mini-agent/log/

### Log naming format
agent_run_YYYYMMDD_HHMMSS.log

### Log contents

Each log file records the complete process of a single run:

1. REQUEST: User messages and available tools
2. RESPONSE: LLM reasoning and tool calls
3. TOOL_RESULT: Detailed tool execution results

The same behavior is also documented in SKILL.md, lines 136-146.

Technical Analysis

The documented logging design stores the complete Agent interaction, including user messages, LLM reasoning, tool calls, and detailed tool results. Normal development and system-administration tasks can cause source code, configuration contents, command output, personal data, access tokens, API keys, or other secrets to appear in these records.

The audited documentation does not specify secret redaction, field-level filtering, restrictive file permissions, encryption at rest, bounded retention, secure deletion, or automatic log rotation. It also describes inspection through wildcard-based shell commands, indicating that multiple historical sessions may remain available.

Persistent recording is useful for debugging, but retaining complete prompts and tool output exceeds the minimum data collection needed for ordinary operational logs. Reasoning traces and complete file or command results should not be logged by default.

Attack Path

1. A user asks the Agent to inspect a configuration file, debug an authenticated service, process private data, or execute a command with sensitive output.
2. The relevant content appears in the request, response, tool arguments, or tool result.
3. Mini-Agent writes the complete interaction to a timestamped file ...[truncated 1060 chars]

Remediation

View remediation

Remediation Suggestions

1. Disable complete prompt, reasoning, and tool-result logging by default.
2. Log only minimum operational metadata such as timestamps, request identifiers, tool names, status codes, durations, and sanitized error categories.
3. Apply structured redaction for API keys, authorization headers, cookies, passwords, private keys, tokens, and common credential formats before data reaches disk.
4. Avoid retaining internal reasoning traces and full file or command contents.
5. Create the log directory and files with owner-only permissions, such as directory mode 0700 and file mode 0600.
6. Introduce configurable retention limits, size limits, automatic rotation, and secure deletion.
7. Make verbose diagnostic logging explicitly opt-in and display a warning that sensitive data may be recorded.
8. Encrypt logs at rest where retention is operationally necessary and restrict access to authorized administrators.
9. Prevent logs from being included automatically in backups, telemetry, support bundles, or public bug reports.
10. Add tests confirming that representative credentials and secrets are consistently redacted.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation explicitly states that logs contain full user requests, available tools, model 'thinking', tool calls, and detailed tool results. In an agent with file operations and command execution, this can capture secrets, file contents, credentials, command output, and other sensitive data far beyond what is needed for normal troubleshooting, creating a meaningful confidentiality risk if logs are read by other local users, backed up, or exfiltrated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide describes comprehensive run logging without any warning that user messages, tool outputs, and internal model data may include sensitive information such as API keys, source code, personal data, or command results. Because this skill is a coding assistant with filesystem and shell access, the privacy exposure is amplified: normal usage can easily place secrets and proprietary data into persistent logs.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

By documenting that logs include full user messages, model reasoning, and detailed tool results, the skill normalizes storage of potentially highly sensitive material in plain run logs. In this agent context, tool results may include file contents, environment-derived secrets, system paths, and command output, so log disclosure could expose both user data and operational secrets.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The examples explicitly demonstrate destructive file operations such as fully overwriting files without any warning, confirmation step, or recommendation to back up data first. In a skill that supports direct file manipulation, normalizing these actions as routine can lead users or downstream agents to perform irreversible changes and accidental data loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The process-stopping example encourages terminating a service on a port without noting that this may interrupt production workloads, affect other users, or stop the wrong process. Because this skill includes command execution and system operations, omission of cautionary context increases the chance of accidental service disruption.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Bulk rename and global text replacement examples describe sweeping multi-file modifications with no warning about scope, irreversibility, or the need to preview matches first. In a coding assistant with file and command capabilities, this can propagate accidental corruption or large-scale unintended changes across many files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README explicitly promotes file operations, command execution, and service management but provides no safety guidance, confirmation requirements, or warnings about potentially destructive actions. In an agent skill context, this can normalize risky usage and increase the chance that users invoke impactful operations without understanding consequences such as data loss, unintended process execution, or exposed services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly advertises destructive file writes, arbitrary shell execution, and background process control, but provides no warning about risks such as data loss, system modification, or persistent process abuse. In a general-purpose agent skill, these capabilities materially increase the chance that users invoke dangerous actions without informed consent or appropriate safeguards.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The logging section states that requests, responses, and tool results are recorded, including messages and tool calls, but it does not warn that sensitive prompts, credentials, file contents, or command output may be persisted to disk. This creates a confidentiality risk because users may unknowingly expose secrets or private data through routine use of the skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

SQP-3 applies to natural-language policy issues in any file type, including markdown. The document presents all user-facing instructions only in Chinese and does not indicate that the language is optional, user-selectable, or required for a specific region-specific purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The skill documentation is entirely presented in Chinese and does not indicate that other languages are supported or that the language choice is optional. This can constitute a language/locale policy issue when the skill appears generally applicable rather than explicitly region-specific.

Content

No source excerpt is available for this finding.