ClawHub
Back to skill

Security audit

minimax-tools

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed MiniMax image-analysis and web-search helper, with privacy, credential-storage, and installer-safety caveats but no artifact-backed malicious behavior.

Install only if you are comfortable sending chosen images, prompts, and search queries to MiniMax through the MCP package. Prefer an environment variable or secret manager over a plaintext config file, restrict config-file permissions if you use one, verify the uv installer and minimax-coding-plan-mcp package before running them, and avoid sending sensitive local images or confidential queries.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (11)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill documentation describes capabilities that access environment variables, read local files, use the network, and invoke shell commands, but it does not declare any permissions or constraints. This creates a trust gap: an agent may invoke a skill with broader side effects than users or policy expect, increasing the chance of unintended data exposure or command execution.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The trigger conditions are broad natural-language phrases like image analysis, web search, and querying latest information, which can match many unrelated user requests. Over-broad activation increases the risk that the skill is invoked unexpectedly and performs networked or shell-backed actions when a safer or narrower tool should have been used.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The script reads an API key from the environment or a local config file and forwards it to an external subprocess without any user-visible disclosure or trust validation of that subprocess. In a skill ecosystem, this expands the exposure of credentials to another executable that could log, misuse, or exfiltrate the key if the dependency is compromised.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill sends user-supplied image and prompt data to an external API via MCP, but the file provides no warning, consent flow, or data-handling notice. Because images and prompts may contain sensitive personal or proprietary information, silent transmission to a third party creates a real privacy and compliance risk.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The script loads a sensitive API key and injects it into a subprocess environment without any user-facing disclosure or trust check on the spawned MCP tool. If the MCP package or its execution path is compromised, the credential can be exfiltrated; this matters more here because the skill's purpose is network search, so external communication is expected and easier to hide.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
User query data is sent to an external service through the MCP subprocess, but the script provides no explicit notice, consent flow, or data handling warning. In a search skill this behavior is functionally expected, which lowers suspicion, but it is still a real privacy/security concern because user prompts may contain sensitive information and are transmitted off-host.

Session Persistence

Medium
Category
Rogue Agent
Content
配置 API Key：
```bash
mkdir -p ~/.openclaw/config
cat > ~/.openclaw/config/minimax.json << EOF
{
  "api_key": "你的API密钥",
Confidence
88% confidence
Finding
The skill instructs users to persist an API key in a file under the home directory and alternatively export it as an environment variable, creating long-lived credentials on disk or in session state. Persistent secrets increase the blast radius of host compromise, accidental disclosure, backup leakage, or reuse across sessions and devices.

External Script Fetching

Low
Category
Supply Chain
Content
which uvx

# 如果不存在，安装 uv
curl -LsSf https://astral.sh/uv/install.sh | sh
```

#### 步骤 2: 安装 MCP 服务器
Confidence
97% confidence
Finding
The documentation tells users to fetch and execute a remote install script directly from the network. This is dangerous because compromise of the remote host, CDN, DNS, TLS termination, or supply chain could lead to arbitrary code execution on the target device during setup.

External Script Fetching

Low
Category
Supply Chain
Content
3. **依赖安装**（在新设备上执行）：
   ```bash
   # 安装 uv（如需要）
   curl -LsSf https://astral.sh/uv/install.sh | sh
   
   # 安装 MCP 服务器
   uvx install minimax-coding-plan-mcp
Confidence
97% confidence
Finding
This repeats the same remote script execution pattern in the migration instructions, extending the risky behavior to every new device where the skill is installed. Repetition makes exploitation more likely because users may normalize unsafe installation steps across multiple systems.

Chaining Abuse

High
Category
Tool Misuse
Content
which uvx

# 如果不存在，安装 uv
curl -LsSf https://astral.sh/uv/install.sh | sh
```

#### 步骤 2: 安装 MCP 服务器
Confidence
98% confidence
Finding
Piping network content directly into sh creates an immediate command-execution chain with no opportunity for inspection or verification. In the context of a skill that already advertises shell and network use, this materially increases the chance of host compromise if the fetched content is malicious or tampered with.

Chaining Abuse

High
Category
Tool Misuse
Content
3. **依赖安装**（在新设备上执行）：
   ```bash
   # 安装 uv（如需要）
   curl -LsSf https://astral.sh/uv/install.sh | sh
   
   # 安装 MCP 服务器
   uvx install minimax-coding-plan-mcp
Confidence
98% confidence
Finding
The same command-chaining pattern appears again in the cross-device migration section, meaning the unsafe execution path is part of the documented operational workflow rather than a one-off example. That makes the issue more dangerous because it encourages repeated arbitrary code execution on additional hosts.

Static analysis

No suspicious patterns detected.