Minimax Web Search

• Analyzed: May 18, 2026, 8:46 AM
• Findings: 1
• Version: 1.1.0
• Hash: ab82b0954d8259eb16755c4b4a691a4e3748b2060eb42231efd3cb6ab30029ba
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill contains a hardcoded, plaintext API key (MINIMAX_API_KEY) within both scripts/mmsearch.py and scripts/mmvision.py, which is a significant security vulnerability. While the scripts appear to perform their stated functions of web search and image analysis using the MiniMax MCP server, the use of 'uvx' to dynamically fetch and execute a remote package at runtime poses a potential supply chain risk.