Security audit

minimax-tools

Security checks for vulnerabilities and agentic risk

Overview

This skill appears intended to provide MiniMax image understanding and web search, but its install and runtime path relies on unverified shell installers and unpinned external code that receives user credentials and the inherited environment.

Review before installing. Use a verified, pinned installation path for uv and minimax-coding-plan-mcp, avoid piping remote scripts into sh, and do not run this in an environment containing unrelated secrets. Use a scoped MiniMax API key and assume image references, prompts, and search queries may be sent to the configured MiniMax service.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:28
Finding: Unverified Remote Installer Executed Through a Shell Pipeline
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: scripts/understand_image.py:55
Finding: Unpinned Third-Party MCP Package Is Retrieved and Executed
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (27)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: 声明包含两个主要能力：图像理解和网络搜索/最新资讯查询。但提供的代码块只围绕 understand_image 工具展开，输入参数也仅为 image_path_or_url 和 prompt，没有搜索关键词、搜索工具调用、HTTP 检索流程或其他与网络搜索相关的实现。因此，代码行为只覆盖了声明中的“图像理解”部分，未覆盖“网络搜索、在线搜索、查询最新资讯/新闻/资料”这一重要能力。虽然代码会访问 MiniMax API 主机，但这是实现图像理解 MCP 调用的支撑细节，不等同于实现网络搜索能力。故描述与实际行为存在实质性不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 代码的核心行为与“网络搜索”部分基本一致，但与声明中的“图像理解”不一致。该脚本只接受一个命令行 query 参数，调用 MCP 的 web_search 工具，没有处理图片路径、二进制图像、图像 URL、OCR、视觉模型调用或任何图像理解流程。因此，描述将技能表述为同时支持图像理解和网络搜索，超出了该代码块实际提供的能力，属于描述与行为不完全匹配。
Content: No source excerpt is available for this finding.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: Piping network output directly into 'sh' is a classic command-chaining hazard because untrusted remote content is executed immediately. In the context of an agent skill that already uses shell and network capabilities, this pattern materially increases the risk of full host compromise during setup.
Content: Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.
which uvx

如果不存在，安装 uv

curl -LsSf https://astral.sh/uv/install.sh | sh

text
#### 步骤 2: 安装 MCP 服务器

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The repeated '| sh' pattern in device migration instructions compounds the same risk and encourages unsafe operator behavior across environments. An attacker who can influence the fetched content would gain arbitrary code execution on each target device.
Content: Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

依赖安装（在新设备上执行）：
bash
# 安装 uv（如需要） curl -LsSf https://astral.sh/uv/install.sh | sh # 安装 MCP 服务器 uvx install minimax-coding-plan-mcp

Env Variable Harvesting

High

Category: Data Exfiltration
Confidence: 96% confidence
Finding: The child process inherits the full parent environment via {**os.environ, **env}, which can expose unrelated secrets, tokens, proxy settings, and sensitive runtime configuration to the external MCP executable. Because that executable is separately resolved and not pinned in this script, the skill context makes this notably more dangerous: an unexpected or compromised tool would gain broad access to host secrets beyond the single API key it actually needs.
Content: Scanner excerpt · scripts/understand_image.py (reported line 69)May include surrounding context.
python
stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, env={**os.environ, **env}, text=True )

Env Variable Harvesting

High

Category: Data Exfiltration
Confidence: 95% confidence
Finding: Merging the full parent environment into the child process with {**os.environ, **env} needlessly exposes all inherited secrets and tokens to the external executable, not just the MiniMax credential. This is especially dangerous in an agent environment, where the parent may carry unrelated cloud keys, CI tokens, or session credentials that the child process could read or leak.
Content: Scanner excerpt · scripts/web_search.py (reported line 67)May include surrounding context.
python
stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, env={**os.environ, **env}, text=True )

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill documents capabilities that require environment access, file reads, network access, and shell execution, but it declares no explicit tool scope or permission boundaries. In an agent setting, that omission increases the chance the skill is invoked with broader privileges than necessary, enabling unintended command execution, secret access, or network activity.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The activation conditions are broad enough to match common requests like image analysis, online search, and current information queries. In an agent ecosystem, overly broad triggers can cause this skill to activate frequently and grant shell/network behavior in situations where a safer or narrower tool should be used.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs users to run an MCP package via uvx without pinning a version. This creates a supply-chain risk because future package updates or a compromised release could execute unexpected code on the host when the skill is installed or invoked.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Using 'uvx install minimax-coding-plan-mcp' without a fixed version allows installation of whatever the latest package resolves to at that time. That makes the skill non-reproducible and exposes users to malicious or vulnerable upstream releases.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 90% confidence
Finding: The alternative guidance also promotes setting a reusable API key for later sessions, creating persistent credentials beyond the immediate task. Persistent secrets are a common post-compromise target and increase blast radius if the workstation or agent environment is accessed by another process.
Content: Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.
配置 API Key：

bash
mkdir -p ~/.openclaw/config cat > ~/.openclaw/config/minimax.json << EOF { "api_key": "你的API密钥",

Session Persistence

Medium

Category: Rogue Agent
Confidence: 90% confidence
Finding: The alternative guidance also promotes setting a reusable API key for later sessions, creating persistent credentials beyond the immediate task. Persistent secrets are a common post-compromise target and increase blast radius if the workstation or agent environment is accessed by another process.
Content: Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.
配置 API Key:

bash
mkdir -p ~/.openclaw/config cat > ~/.openclaw/config/minimax.json << EOF { "api_key": "你的API密钥",

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The migration instructions repeat unpinned installation of the MCP server on new devices. Repeating the unsafe pattern across devices broadens exposure to a compromised or malicious package release.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The troubleshooting guidance again recommends unpinned installation, normalizing execution of an unreviewed latest package. This increases the chance that users reinstall a malicious or broken dependency during incident conditions.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest claims the skill uses MiniMax MCP for image understanding and search, but this implementation achieves that by launching the external 'uvx minimax-coding-plan-mcp' process. Executing a subprocess is a broader capability than simple image analysis and is not disclosed in the stated purpose.
Content: No source excerpt is available for this finding.

Tainted flow: 'env' from os.environ.get (line 28, credential/environment) → subprocess.Popen (code execution)

Medium

Category: Data Flow
Confidence: 65% confidence
Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
Content: Scanner excerpt · scripts/understand_image.py (reported line 64)May include surrounding context.
python
] try: proc = subprocess.Popen( ['uvx', 'minimax-coding-plan-mcp'], stdin=subprocess.PIPE, stdout=subprocess.PIPE,

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The script relies on running an external MCP tool via uvx without any visible version pinning, which creates supply-chain risk if the resolved package changes or is compromised. In a skill that processes user-supplied image paths/URLs and prompts, executing an unpinned external tool increases the chance of unexpected or malicious code running with access to local environment data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script loads a sensitive API key from the user's environment or config file and forwards it to an external MCP process without any user-facing disclosure or consent at the point of use. In an agent skill context, this matters because a seemingly simple web-search action silently causes credentialed outbound activity through another executable.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/understand_image.py (reported line 64)May include surrounding context.
python
] try: proc = subprocess.Popen( ['uvx', 'minimax-coding-plan-mcp'], stdin=subprocess.PIPE, stdout=subprocess.PIPE,

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/web_search.py (reported line 62)May include surrounding context.
python
] try: proc = subprocess.Popen( ['uvx', 'minimax-coding-plan-mcp'], stdin=subprocess.PIPE, stdout=subprocess.PIPE,

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The code silently spawns an external MCP tool that performs outbound service access, but there is no transparency to the user at this execution point about the subprocess launch, network use, or data handling. In an agent skill, hidden external execution is security-relevant because user queries may be transmitted off-box unexpectedly.
Content: No source excerpt is available for this finding.

Tainted flow: 'env' from os.environ.get (line 27, credential/environment) → subprocess.Popen (code execution)

Medium

Category: Data Flow
Confidence: 65% confidence
Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
Content: Scanner excerpt · scripts/web_search.py (reported line 62)May include surrounding context.
python
] try: proc = subprocess.Popen( ['uvx', 'minimax-coding-plan-mcp'], stdin=subprocess.PIPE, stdout=subprocess.PIPE,

External Script Fetching

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: The skill recommends fetching and executing a remote install script directly with curl piped to sh. This removes any opportunity for inspection or integrity verification and allows a compromised upstream host, MITM, or malicious script change to execute arbitrary shell commands on the user's machine.
Content: Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.
which uvx

如果不存在，安装 uv

curl -LsSf https://astral.sh/uv/install.sh | sh

text
#### 步骤 2: 安装 MCP 服务器

External Script Fetching

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: The same remote-script execution pattern is repeated in the migration instructions, extending the supply-chain risk to every new device setup. Because this occurs during installation, compromise would happen before any runtime safeguards in the skill could help.
Content: Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

依赖安装（在新设备上执行）：
bash
# 安装 uv（如需要） curl -LsSf https://astral.sh/uv/install.sh | sh # 安装 MCP 服务器 uvx install minimax-coding-plan-mcp

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The manifest describes this skill as performing image understanding and web search via MiniMax MCP, but does not mention reading credentials from the host environment or user home directory. While this may be operationally necessary, credential and local config access is a separate capability beyond the stated end-user purpose.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T08 · Insecure Dependencies

SkillSpector

Tp4

Tp4

Chaining Abuse

如果不存在，安装 uv

Chaining Abuse

Env Variable Harvesting

Env Variable Harvesting

Undeclared Tool Scope

Vague Triggers

Rp1

Rp1

Session Persistence

Session Persistence

Rp1

Rp1

Context-Inappropriate Capability

Tainted flow: 'env' from os.environ.get (line 28, credential/environment) → subprocess.Popen (code execution)

Rp1

Missing User Warnings

subprocess module call

subprocess module call

Missing User Warnings

Tainted flow: 'env' from os.environ.get (line 27, credential/environment) → subprocess.Popen (code execution)

External Script Fetching

如果不存在，安装 uv

External Script Fetching

Context-Inappropriate Capability

Static analysis