ClawHub
Back to skill

Security audit

Minimax Image

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed MiniMax image-generation skill, but users should avoid putting private text in prompts because prompts are rewritten, logged, and sent to MiniMax.

Install only if you intend to use MiniMax image generation. Use a scoped API key if available, do not include secrets or confidential details in prompts, and be aware that both the original and optimized prompts may appear in local logs and be sent to MiniMax.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
76% confidence
Finding
The invocation description is very broad and overlaps with common user phrasing for image requests, which can cause the skill to trigger in situations the user did not specifically intend. That increases the chance of unintended external API use and transmission of user content to a third party.

Natural-Language Policy Violations

Medium
Confidence
84% confidence
Finding
Forcing prompt optimization and language conversion without explicit consent changes user input before it is sent externally, which can distort meaning and cause unintended or sensitive content to be transmitted. This is more concerning in an image-generation skill because the transformed prompt directly controls third-party output and may not reflect the user's actual request.

Natural-Language Policy Violations

Medium
Confidence
90% confidence
Finding
The documented behavior makes automatic conversion of all Chinese/English input into concise English mandatory, removing user control over how their request is represented. Mandatory transformation can introduce semantic drift, privacy issues, and prompt injection surface if the optimization layer adds content the user did not authorize.

External Transmission

Medium
Category
Data Exfiltration
Content
return { text: "❌ 未找到 API Key，请设置 MINIMAX_API_KEY 或 AIMLAPI_API_KEY 环境变量。" };
    }

    const API_URL = "https://api.minimaxi.com/v1/image_generation";

    // Get user input
    let userInput = context.args.join(' ').trim();
Confidence
84% confidence
Finding
https://api.minimaxi.com/

VirusTotal

57/57 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
index.js:95