Minimax Web Search

使用 MiniMax Coding Plan API 进行网页搜索和图像理解。当用户要求搜索信息、查找资料、或者询问实时内容时使用搜索功能；当用户要求识图、分析图片、描述图片内容时使用 understand_image 功能。触发词：搜索、查找、search、look up、识图、分析图片、图片里是什么

Security Scan

The skill largely does what it claims (search and image understanding via a MiniMax MCP tool) but includes a hard-coded API key and inconsistencies about required credentials, which is a disproportionate and risky design choice.

Purpose & Capability

The scripts (mmsearch.py and mmvision.py) implement web_search and understand_image calls as described. However SKILL.md says MINIMAX_API_KEY is required but the package/registry metadata lists no required env vars/primary credential — the scripts instead embed a hard-coded API key and host, which is unexpected for a user-facing search/vision skill.

Instruction Scope

Runtime instructions simply run the included scripts. Those scripts set an API key in the environment and spawn the 'uvx minimax-coding-plan-mcp' subprocess which will transmit user queries and image data to https://api.minimaxi.com under the embedded key. That means any search queries or uploaded images go to an external account controlled by whoever owns that key; sensitive content could be exposed.

Install Mechanism

There is no install spec (instruction-only). The scripts rely on existing binaries/packages (uvx and minimax-coding-plan-mcp) but do not download or write additional code. This is lower risk than arbitrary downloads, though it will invoke external packages at runtime.

Credentials

The scripts embed a long-lived secret (MINIMAX_API_KEY) and MINIMAX_API_HOST directly into source. The skill does not require the user's own key, instead routing all requests through the embedded token — a disproportionate request (and a likely privacy/billing risk). The manifest/registry also inconsistently lists no required env vars while SKILL.md mentions MINIMAX_API_KEY.

Persistence & Privilege

The skill is not always-enabled and does not request system-wide persistence or modify other skills. Autonomous invocation is allowed (platform default) but not combined here with other high privileges.

What to consider before installing

This skill will send your search queries and any images you provide to api.minimaxi.com using a hard-coded API key embedded in the provided scripts. That means: (1) your data is handled under someone else's account (billing and access belong to the key owner), (2) sensitive queries or images could be observed by the key owner, and (3) you cannot easily use your own credentials without editing the code. Before installing or running: review and remove the hard-coded MINIMAX_API_KEY (replace with your own key stored in an environment variable), verify the API host and the key owner's trustworthiness, avoid sending sensitive images or data, and request source/author information or a homepage. If you already ran these scripts with sensitive data, consider that data exposed and ask the maintainer to revoke/rotate the embedded key. If the author cannot justify embedding the key, treat the package as untrusted.

MiniMax Web Search & Vision

使用 MiniMax Coding Plan MCP 进行网页搜索和图像理解。

搜索

python3 scripts/mmsearch.py "<搜索关键词>"

识图

python3 scripts/mmvision.py "<提示词>" "<图片路径或URL>"

支持的图片格式：JPEG, PNG, WebP

示例：

# 描述图片内容
python3 scripts/mmvision.py "描述这张图片" /path/to/image.png

# 提取图片中的文字
python3 scripts/mmvision.py "提取图片中的所有文字" https://example.com/image.jpg

# 分析图片内容
python3 scripts/mmvision.py "这张图片里有什么？" image.jpg

脚本说明

• scripts/mmsearch.py — 调用 web_search 工具
• scripts/mmvision.py — 调用 understand_image 工具

依赖：

• uvx (Python 包运行器)
• minimax-coding-plan-mcp
• MINIMAX_API_KEY 环境变量（已内置在脚本中）