Minimax Image Generator

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:42 AM UTC
• Version: 1.1.0

Overview

This skill is a straightforward MiniMax image-generation integration with normal API-key and network behavior, though users should note third-party data sharing and local save hardening gaps.

Install only if you are comfortable sending prompts, reference image URLs, or base64 image data to MiniMax under your account. Use a dedicated MiniMax API key, avoid sensitive images or confidential prompts, prefer saving into a dedicated output directory, and consider pinning `requests` before installation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:43

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/minimax_image_gen.py:268

Finding

Unrestricted Download of Remote API-Provided Image URLs

Content

View full analysis

Remediation

View remediation

MAX_IMAGE_BYTES: raise ValueError("Image exceeds maximum permitted size") output.write(chunk) ``` 7. Require an approved image MIME type and verify the actual file signature before retaining the file. 8. Write to a securely created temporary file first, then atomically move it to the final destination after validation. 9. When accepting a caller-provided output path, resolve and restrict it to an approved output directory if arbitrary filesystem destinations are not required. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Tainted flow: 'headers' from os.environ.get (line 58, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/minimax_image_gen.py (reported line 62)May include surrounding context.

python

'Content-Type': 'application/json',
        'Authorization': f'Bearer {key}'
    }
    response = requests.post(url, json=data, headers=headers, timeout=120)
    response.raise_for_status()
    return response.json()

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/minimax_image_gen.py (reported line 25)May include surrounding context.

python

def get_api_key():
    """Get API key from environment or skill config."""
    # Try environment first
    key = os.environ.get('MINIMAX_API_KEY')
    if key:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill documents use of an API key and an external API, but it does not declare an explicit permission or allowed-tools scope. That weakens least-privilege controls and can cause the agent runtime or reviewer to underestimate that the skill can access environment secrets and make outbound network requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill sends user prompts and, for i2i, reference image URLs or base64 image content to the external MiniMax service, but the description does not clearly disclose this data transfer. Users may unknowingly submit sensitive prompts or images to a third party, creating privacy, confidentiality, and compliance risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest in _meta.json says the skill provides only "Text-to-image generation using MiniMax API." However, the provided skill context describes a broader capability: both text-to-image and image-to-image generation using MiniMax models. This is a semantic mismatch between the manifest's declared behavior and the skill's stated functionality.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Prompts and optional reference image data are transmitted to an external third-party API, which can expose sensitive user content if users are unaware of the data-sharing boundary. In an agent skill context, this is more relevant because prompts or image inputs may contain private or proprietary information and there is no explicit consent or warning in the interface.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/minimax_image_gen.py (reported line 62)May include surrounding context.

python

'Content-Type': 'application/json',
        'Authorization': f'Bearer {key}'
    }
    response = requests.post(url, json=data, headers=headers, timeout=120)
    response.raise_for_status()
    return response.json()

Tainted flow: 'filepath' from requests.post (line 363, network input) → open (file write)

Medium

• Category: Data Flow
• Confidence: 89% confidence

Finding

The code writes downloaded content to a caller-controlled filepath without constraining the destination to a safe directory. If this tool is invoked by an untrusted user or agent, it can overwrite arbitrary files accessible to the current user, making this a path traversal / arbitrary file write risk in the local context.

Content

Scanner excerpt · scripts/minimax_image_gen.py (reported line 275)May include surrounding context.

python

response = requests.get(url, timeout=30)
        response.raise_for_status()
        with open(filepath, 'wb') as f:
            f.write(response.content)
        return (True, filepath)
    except Exception as e:

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The natural-language schema values for style_type are only provided in Chinese ("漫画", "元气", "中世纪", "水彩"), which imposes a specific language/locale on users without opt-in. The policy calls for flagging language or locale constraints unless the skill offers a choice or clearly justifies the region-specific requirement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The script accesses a sensitive credential from MINIMAX_API_KEY or ~/.openclaw/openclaw.json. Although this is typical for API-backed tools, there is no explicit disclosure in user-facing text that the skill reads credentials from these locations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The natural-language interface exposes style choices only as Chinese strings ("漫画", "元气", "中世纪", "水彩"). This imposes a specific language in the user-facing API without opt-in or alternative labels, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest describes both text-to-image and image-to-image generation, and the implementation supports both via image_url/image_base64 inputs and an optional --save path that writes downloaded output to disk. However, the exported tool description at L190 says only 'Text-to-image generation', which misrepresents the broader behavior exposed by the code.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Both the tool schema and CLI argument choices expose style values only in Chinese, which is a user-facing language constraint. There is no indication that the skill is region-specific or that users can choose their preferred language.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The argparse description says 'MiniMax Text-to-Image Generation Tool', but the program also accepts --image-url and --image-base64 and sends them as subject_reference for image-to-image transformations. This is an active mismatch between the documentation shown to users and the actual supported behavior.

Content

No source excerpt is available for this finding.