Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Minimax API
v1.0.3Provides image analysis and description from URLs or local files plus real-time web search using MiniMax's Token Plan API.
⭐ 0· 96·0 current·0 all-time
byLiang@matthew77
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The name/description match the included scripts: minimax_image.py implements VLM image calls and minimax_search.py implements search calls to https://api.minimaxi.com. No unrelated services, binaries, or credentials are requested by the capability itself.
Instruction Scope
SKILL.md instructs sending HTTP/HTTPS images or local files; the scripts indeed read local files and convert them to base64 for upload to the external API (this is expected for image analysis). However SKILL.md shows usage that omits the required CLI --api-key argument (it suggests exporting MINIMAX_API_KEY and running the script without --api-key), while the scripts' argparse require --api-key. This mismatch is an operational/instructional incoherence. Also note: local image files are read and their full contents are transmitted to the remote API (privacy/exfiltration risk inherent to the feature).
Install Mechanism
There is no install spec (instruction-only plus included scripts). No downloads or archive extraction are requested. The scripts are simple Python clients using urllib; network access to api.minimaxi.com is required, which is consistent with the stated functionality.
Credentials
Registry metadata lists no required environment variables or primary credential, but SKILL.md and both scripts clearly require a MiniMax API key (SKILL.md suggests MINIMAX_API_KEY; scripts require --api-key). This is an inconsistency: the skill should declare MINIMAX_API_KEY (or otherwise explain how the key is provided). Additionally, the skill will upload base64-encoded local files to a third-party endpoint, so the credential grants network access tied to potentially sensitive data — that should be explicitly declared and limited.
Persistence & Privilege
The skill does not request always:true and does not appear to modify other skills or system settings. It runs as invoked and performs network calls; normal autonomous invocation is allowed by platform defaults (no additional privilege observed).
What to consider before installing
Key points to consider before installing:
- Credential declaration mismatch: The skill actually requires a MiniMax API key (scripts use --api-key and SKILL.md references MINIMAX_API_KEY), but the registry metadata lists no required env var/primary credential. Ask the publisher to fix metadata or code so it's clear how the agent supplies the key. Do not assume the platform will inject a secret unless the skill metadata declares it.
- Usage mismatch: The SKILL.md examples show exporting MINIMAX_API_KEY and running the script without --api-key, but the Python scripts require --api-key. This will cause runtime errors or confusion when integrated; request a corrected SKILL.md or code that reads the env var when present.
- Data exfiltration/privacy: For local files, the script reads the file and encodes it as a data URL (base64) and sends it to https://api.minimaxi.com. That is necessary for remote image analysis but is effectively uploading the entire file to a third party. Avoid providing sensitive images or grant the skill access only to non-sensitive paths.
- Source provenance: The skill has unknown source/homepage. Prefer skills with a verifiable maintainer, repository, or homepage. Verify the domain api.minimaxi.com is legitimate for the service you expect.
- Secret handling: Do not pass API keys on the command line if others can view shell history/process list; prefer secure secret storage offered by the platform (and confirm how the agent will supply the key). If you must export to a shell, be aware of shell history and ~/.bashrc persistence implications.
- Operational fix suggestions: Require the publisher to (1) declare MINIMAX_API_KEY in registry metadata as a required/primary credential, (2) either accept the env var in the scripts (fallback from MINIMAX_API_KEY) or update SKILL.md to require passing --api-key, and (3) provide a verified homepage or source repository.
Given these inconsistencies (missing declared credential and conflicting usage instructions) and the privacy implications of uploading local files, treat this skill cautiously until the publisher corrects metadata and usage guidance.Like a lobster shell, security has layers — review code before you run it.
latestvk976p7vjb9834pnrmejjmy492d839q2k
License
MIT-0
Free to use, modify, and redistribute. No attribution required.