Minimax Web Search

• Outcome: Review
• Latest audit: May 29, 2026 · 9:26 PM UTC
• Version: 1.1.0

Overview

This skill performs the stated MiniMax search and image-analysis functions, but it embeds a live-looking API key and runs an unpinned external MCP package that can send user queries and images to MiniMax.

Install only if you trust the embedded MiniMax credential and the runtime MCP package. Prefer a version that uses your own declared API key, pins the MCP package version, and warns before sending sensitive search terms, image URLs, or local images to MiniMax.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill invokes local Python scripts, uses environment variables, and performs shell-capable actions, yet the manifest does not declare corresponding permissions. This weakens security review and consent boundaries because users and hosting systems cannot clearly see that the skill can access env-backed secrets and execute commands.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documentation states the skill performs web search and image understanding, but it also indicates that a MiniMax API key is built into the scripts and that external API calls occur. Hidden credential use and undisclosed outbound communication are dangerous because they can expose sensitive user queries, image URLs, or local image-derived data to a third-party service without informed consent.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script embeds a live-looking MiniMax API key directly in source code and exports it into the process environment. Hardcoded secrets are easily leaked through source control, logs, redistribution, or reuse by unauthorized parties, enabling abuse of the linked account and paid API access.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: A live MiniMax API credential is hard-coded directly in the script, which exposes a secret to anyone who can read the file, logs, repository history, or packaged skill contents. An attacker can reuse the key to access the vendor account, incur charges, or abuse the associated API privileges.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger list includes broad everyday phrases such as “搜索”, “查找”, “search”, and “look up”, which can cause the skill to activate unintentionally in normal conversation. In a skill that sends data to an external provider, accidental activation increases the risk of unnecessary data disclosure and surprise tool execution.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation shows that users can pass search queries, image paths, and image URLs to the tool, but it does not warn that this information may be sent to MiniMax. This omission is risky because users may provide sensitive terms, private file references, or proprietary image URLs without understanding that a third party will process them.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: Loading a fixed API credential into the environment without user awareness creates covert credential use and hides the fact that the skill is operating under an embedded account. In this skill context, a web-search wrapper does not need to ship with a baked-in secret, so the undisclosed credential use is especially inappropriate and dangerous.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill sends user-supplied search queries to an external network-backed service via an MCP subprocess, but the script provides no user-facing notice that prompts may leave the local environment. This is risky because search terms can contain sensitive or proprietary information, and the skill description encourages use for real-time lookup tasks where users may not expect data exfiltration to a third party.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The script silently loads a hard-coded API key into the environment without any disclosure or user control, concealing use of an embedded third-party credential. In a skill context, this is more dangerous because users may unknowingly trigger calls billed to a hidden account and normalize unsafe secret-handling practices.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill sends user-supplied images to a remote API-backed MCP service without any visible warning, consent prompt, or disclosure of network transmission. In an image-understanding skill, this matters because images may contain sensitive personal, biometric, document, or location data that users may assume is processed locally.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.