MiniMax Image Generation

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:32 AM UTC
• Version: 1.1.1

Overview

This MiniMax image skill is mostly coherent, but it needs Review because its downloader can fetch unvalidated URLs and overwrite arbitrary user-writable files through the output path.

Install only if you are comfortable sending prompts and reference images to MiniMax, storing generated images and prompt summaries locally, and managing the API key yourself. Avoid sensitive images or prompts, prefer base64 mode or a dedicated output directory, and do not let an agent choose arbitrary --output paths for important files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/image_gen.py:156

Finding

Unvalidated Remote Image Downloads and Arbitrary File Overwrite

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: README.md:28

Finding

Unpinned Package Execution in Installation Instructions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tainted flow: 'req' from os.environ.get (line 132, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/image_gen.py (reported line 140)May include surrounding context.

python

)
    
    try:
        with urllib.request.urlopen(req, timeout=60) as resp:
            result = json.loads(resp.read().decode("utf-8"))
            
            if result.get("base_resp", {}).get("status_code") != 0:

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The README instructs users to run npx clawhub install lx-minimax without pinning a specific package version. This creates a supply-chain risk: users may install a newer or compromised release than the author reviewed, and package contents can change over time. In the context of an install command, this is materially relevant because it directly affects what code is fetched and executed on the user's system.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The Chinese installation section repeats the same unpinned npx clawhub install lx-minimax command, carrying the same supply-chain risk. Because installation commands are high-trust copy/paste targets, an unpinned dependency reference increases exposure to malicious or unexpected future package changes.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill documentation describes access to sensitive capabilities including an environment variable for an API key, outbound network access to a third-party API, and local file writes, but it does not declare any explicit tool scope or permissions. This is dangerous because consumers and enforcement systems cannot easily constrain or review the skill's required privileges, increasing the risk of over-privileged execution, unintended data exfiltration of prompts/reference images/API keys, or writes outside expected boundaries if the implementation changes or is abused.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation states that the script will automatically download generated images to a local filesystem path, but it does not clearly foreground this side effect, discuss storage/security implications, or describe any user consent/opt-out behavior. In an agent skill context, automatic writes to disk can create privacy, data retention, and workspace contamination risks, especially when handling externally sourced URLs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation states that the script automatically downloads remote image URLs and writes them to /home/ubuntu/.openclaw/workspace/images/ without clearly foregrounding that local disk writes will occur. In an agent/tool context, silent file creation from external content can surprise users, consume disk space, persist untrusted data, and create downstream risk if other components later process those files.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 9)May include surrounding context.

md

from datetime import datetime


API_BASE = "https://api.minimaxi.com/v1/image_generation"

# MiniMax API Key - set MINIMAX_API_KEY environment variable
API_KEY = os.environ.get("MINIMAX_API_KEY", "")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api_en.md (reported line 9)May include surrounding context.

md

from datetime import datetime


API_BASE = "https://api.minimaxi.com/v1/image_generation"

# MiniMax API Key - set MINIMAX_API_KEY environment variable
API_KEY = os.environ.get("MINIMAX_API_KEY", "")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/image_gen.py (reported line 17)May include surrounding context.

python

from datetime import datetime


API_BASE = "https://api.minimaxi.com/v1/image_generation"

# MiniMax API Key - set MINIMAX_API_KEY environment variable
API_KEY = os.environ.get("MINIMAX_API_KEY", "")

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script hardcodes Chinese-only user-facing log labels and descriptions such as generation type, headers, and explanatory text. This imposes a specific language/locale on outputs without offering the user a choice or documenting a justified locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The README includes a dedicated Chinese section with examples and parameter guidance that presumes Chinese-language usage for that portion of the skill documentation. While the file also provides an English section, the skill documentation itself does not state that language selection is optional at runtime or that the skill accepts either locale equally, which can be read as locale-specific guidance without explicit opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file's operational instructions and parameter explanations are primarily written in Chinese, which effectively imposes a specific language on users. The document does not indicate that Chinese is intentional for a region-specific audience, nor does it offer an alternative language option or note about locale expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.