MiniMax Media Generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:25 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches a MiniMax media-generation purpose, but it ships unsafe executable scripts that expose a hardcoded API key and can mishandle user-entered credentials during installation.

Review this skill carefully before installing. Do not run the installer with a copied or untrusted API key value, avoid using the bundled generate.sh script, rotate any exposed MiniMax key if you own it, and only install after the scripts are fixed to remove hardcoded credentials, quote heredocs safely, and document local secret storage and config changes.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: generate.sh:5

Finding

Hardcoded MiniMax API Credential in Executable Script

Content

View full analysis

``` 4. The attacker invokes any API capabilities and models authorized for the compromised account. 5. Requests consume the account's quota and may incur charges until the credential is revoked. ### Impact Assessment The attacker obtains the MiniMax API privileges associated with the exposed key. Potential consequences include: - Unauthorized image, video, speech, or music generation. - Consumption or exhaustion of paid API quota. - Financial charges to the credential owner. - Account abuse or policy violations attributed to the owner. - Continued unauthorized use through old repository versions or cached ...[truncated 171 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/install.sh:68

Finding

Arbitrary Python Code Injection Through Installer API-Key Input

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: generate.sh:30

Finding

Predictable Shared Temporary Files Allow Symlink-Based File Overwrite

Content

View full analysis

/tmp/tts_resp.json python3 << 'PYEOF' import json with open('/tmp/tts_resp.json') as f: d = json.load(f) ``` A second predictable file is used by the music path at `generate.sh:79-89`: ```bash curl -s -X POST "$BASE_URL/v1/music_generation" \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d "{\"model\":\"music-2.6\",\"prompt\":\"$prompt\",\"lyrics\":\"$lyrics\"}" \ > /tmp/music_resp.json python3 << 'PYEOF' import json with open('/tmp/music_resp.json') as f: d = json.load(f) ``` ### Technical Analysis The script writes responses to fixed names in the globally shared `/tmp` directory using ordinary shell redirection. It does not create the files exclusively, check ownership, reject symbolic links, set restrictive permissions, or remove the files afterward. On systems where symlink protections do not prevent the operation—or where another process running under the same account can prepare the path—an attacker can create one of these names as a symbolic link to another file writable by the victim. Shell redirection then follows the link and truncates or overwrites the target. The predictable names also create confidentiality and integrity risks: other local processes may read API responses, replace them before parsing, or cause concurrent invocations to interfere with one another. ### Attack Path 1. An attacker with local access creates a malicious link before the victim runs the script: ```bash ln -s /path/to/victim-writable-file /tmp/tts_resp.json ...[truncated 1091 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (51)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 103)May include surrounding context.

从 openclaw.json 的 skills.entries 中移除配置，并删除插件目录：

bash

rm -rf ~/.openclaw/skills/rocky-minimax-media

然后重启网关。

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.zh_CN.md (reported line 103)May include surrounding context.

从 openclaw.json 的 skills.entries 中移除配置，并删除插件目录：

bash

rm -rf ~/.openclaw/skills/rocky-minimax-media

然后重启网关。

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 103)May include surrounding context.

从 openclaw.json 的 skills.entries 中移除配置，并删除插件目录：

bash

rm -rf ~/.openclaw/skills/rocky-minimax-media

然后重启网关。

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.zh_CN.md (reported line 103)May include surrounding context.

从 openclaw.json 的 skills.entries 中移除配置，并删除插件目录：

bash

rm -rf ~/.openclaw/skills/rocky-minimax-media

然后重启网关。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill documentation instructs users to run an install script that modifies ~/.openclaw/openclaw.json and adds a provider entry, while the manifest presents the skill primarily as a media-generation plugin. That undeclared configuration modification is security-relevant because it changes local trust/config state and could affect how the host routes future model traffic.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill documentation instructs users to run an install script that modifies ~/.openclaw/openclaw.json and adds a provider entry, while the manifest presents the skill primarily as a media-generation plugin. That undeclared configuration modification is security-relevant because it changes local trust/config state and could affect how the host routes future model traffic.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

A live API credential is hardcoded directly in the script and then sent with outbound requests. Anyone who can view, copy, or redistribute this skill can reuse the credential to access the external service, incur charges, or act as the account owner; in this skill context, network use is expected, which makes embedded secrets especially dangerous because they are immediately usable.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · generate.sh (reported line 14)May include surrounding context.

sh

prompt="${2:-未来科技风格的大脑神经网络}"
    filename="${3:-output.jpg}"
    echo "生成图片: $prompt"
    url=$(curl -s -X POST "$BASE_URL/v1/image_generation" \
      -H "Authorization: Bearer $API_KEY" \
      -H "Content-Type: application/json" \
      -d "{\"model\":\"image-01\",\"prompt\":\"$prompt\",\"extra_params\":{\"image_size\":\"16:9\"}}" \

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · generate.sh (reported line 20)May include surrounding context.

sh

-d "{\"model\":\"image-01\",\"prompt\":\"$prompt\",\"extra_params\":{\"image_size\":\"16:9\"}}" \
      | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('data',{}).get('image_urls',[''])[0])")
    if [ -n "$url" ] && [ "$url" != "" ]; then
      curl -s -L "$url" -o "$OUTPUT_DIR/$filename"
      echo "✅ 已保存: $OUTPUT_DIR/$filename"
    else
      echo "❌ 生成失败"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · generate.sh (reported line 59)May include surrounding context.

sh

echo "等待生成完成..."
    for i in {1..30}; do
      sleep 5
      status=$(curl -s "$BASE_URL/v1/query/video_generation?task_id=$task_id" \
        -H "Authorization: Bearer $API_KEY" \
        | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('status',''))")
      echo "状态: $status"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · generate.sh (reported line 64)May include surrounding context.

sh

echo "等待生成完成..."
    for i in {1..30}; do
      sleep 5
      status=$(curl -s "$BASE_URL/v1/query/video_generation?task_id=$task_id" \
        -H "Authorization: Bearer $API_KEY" \
        | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('status',''))")
      echo "状态: $status"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · generate.sh (reported line 67)May include surrounding context.

sh

file_id=$(curl -s "$BASE_URL/v1/query/video_generation?task_id=$task_id" \
          -H "Authorization: Bearer $API_KEY" \
          | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('file_id',''))")
        download_url=$(curl -s "$BASE_URL/v1/files/retrieve?file_id=$file_id" \
          -H "Authorization: Bearer $API_KEY" \
          | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('file',{}).get('download_url',''))")
        curl -s -L "$download_url" -o "$OUTPUT_DIR/video.mp4"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/minimax.sh (reported line 129)May include surrounding context.

sh

echo ""
  
  echo "1. 图片生成..."
  resp=$(curl -s --max-time 15 -X POST "$BASE_URL/v1/image_generation" \
    -H "Authorization: Bearer $MINIMAX_API_KEY" \
    -H "Content-Type: application/json" \
    -d '{"model":"image-01","prompt":"test","extra_params":{"image_size":"1:1"}}')

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/minimax.sh (reported line 137)May include surrounding context.

sh

[ "$code" = "0" ] && log "图片生成 ✅" || err "图片生成 ❌ ($code)"
  
  echo "2. TTS语音..."
  resp=$(curl -s --max-time 10 -X POST "$BASE_URL/v1/t2a_v2" \
    -H "Authorization: Bearer $MINIMAX_API_KEY" \
    -H "Content-Type: application/json" \
    -d '{"model":"speech-2.8-hd","text":"test","stream":false,"voice_setting":{"voice_id":"male-qn-qingse"}}')

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/minimax.sh (reported line 145)May include surrounding context.

sh

[ "$code" = "0" ] && log "TTS语音 ✅" || err "TTS语音 ❌ ($code)"
  
  echo "3. 视频生成 (MiniMax-Hailuo-2.3)..."
  resp=$(curl -s --max-time 10 -X POST "$BASE_URL/v1/video_generation" \
    -H "Authorization: Bearer $MINIMAX_API_KEY" \
    -H "Content-Type: application/json" \
    -d '{"model":"MiniMax-Hailuo-2.3","prompt":"test"}')

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/minimax.sh (reported line 153)May include surrounding context.

sh

[ "$code" = "0" ] && log "视频生成 ✅" || err "视频生成 ❌ ($code)"
  
  echo "4. 视频生成 (MiniMax-Hailuo-2.3-Fast)..."
  resp=$(curl -s --max-time 10 -X POST "$BASE_URL/v1/video_generation" \
    -H "Authorization: Bearer $MINIMAX_API_KEY" \
    -H "Content-Type: application/json" \
    -d '{"model":"MiniMax-Hailuo-2.3-Fast","prompt":"test"}')

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/minimax.sh (reported line 161)May include surrounding context.

sh

[ "$code" = "0" ] && log "视频生成-Fast ✅" || err "视频生成-Fast ❌ ($code)"
  
  echo "5. 音乐生成 (music-2.6)..."
  resp=$(curl -s --max-time 10 -X POST "$BASE_URL/v1/music_generation" \
    -H "Authorization: Bearer $MINIMAX_API_KEY" \
    -H "Content-Type: application/json" \
    -d '{"model":"music-2.6","prompt":"test","lyrics":"test"}')

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/minimax.sh (reported line 179)May include surrounding context.

sh

read -p "请输入图片描述 [默认: 科技感大脑]: " PROMPT
  PROMPT=${PROMPT:-科技感大脑}
  
  resp=$(curl -s --max-time 30 -X POST "$BASE_URL/v1/image_generation" \
    -H "Authorization: Bearer $MINIMAX_API_KEY" \
    -H "Content-Type: application/json" \
    -d "{\"model\":\"image-01\",\"prompt\":\"$PROMPT\",\"extra_params\":{\"image_size\":\"16:9\"}}")

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/minimax.sh (reported line 215)May include surrounding context.

sh

*) VOICE_ID="male-qn-qingse" ;;
  esac
  
  resp=$(curl -s --max-time 15 -X POST "$BASE_URL/v1/t2a_v2" \
    -H "Authorization: Bearer $MINIMAX_API_KEY" \
    -H "Content-Type: application/json" \
    -d "{\"model\":\"speech-2.8-hd\",\"text\":\"$TEXT\",\"stream\":false,\"voice_setting\":{\"voice_id\":\"$VOICE_ID\"}}")

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/minimax.sh (reported line 265)May include surrounding context.

sh

PROMPT=${PROMPT:-神经元活动动画}
  
  info "正在创建视频任务..."
  resp=$(curl -s --max-time 10 -X POST "$BASE_URL/v1/video_generation" \
    -H "Authorization: Bearer $MINIMAX_API_KEY" \
    -H "Content-Type: application/json" \
    -d "{\"model\":\"$MODEL\",\"prompt\":\"$PROMPT\"}")

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/minimax.sh (reported line 281)May include surrounding context.

sh

info "等待视频生成（约60秒）..."
  for i in {1..12}; do
    sleep 5
    status=$(curl -s "$BASE_URL/v1/query/video_generation?task_id=$task_id" \
      -H "Authorization: Bearer $MINIMAX_API_KEY" \
      | python3 -c "import sys,json; print(json.load(sys.stdin).get('status',''))" 2>/dev/null)
    echo -n "."

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/minimax.sh (reported line 289)May include surrounding context.

sh

info "等待视频生成（约60秒）..."
  for i in {1..12}; do
    sleep 5
    status=$(curl -s "$BASE_URL/v1/query/video_generation?task_id=$task_id" \
      -H "Authorization: Bearer $MINIMAX_API_KEY" \
      | python3 -c "import sys,json; print(json.load(sys.stdin).get('status',''))" 2>/dev/null)
    echo -n "."

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/minimax.sh (reported line 292)May include surrounding context.

sh

file_id=$(curl -s "$BASE_URL/v1/query/video_generation?task_id=$task_id" \
      -H "Authorization: Bearer $MINIMAX_API_KEY" \
      | python3 -c "import sys,json; print(json.load(sys.stdin).get('file_id',''))" 2>/dev/null)
    url=$(curl -s "$BASE_URL/v1/files/retrieve?file_id=$file_id" \
      -H "Authorization: Bearer $MINIMAX_API_KEY" \
      | python3 -c "import sys,json; print(json.load(sys.stdin).get('file',{}).get('download_url',''))" 2>/dev/null)
    filename="minimax-video-$(date +%Y%m%d-%H%M%S).mp4"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

While this is not script fetching specifically, it is a real security issue because the script follows a remote URL and writes the response directly to disk with no trust validation. In a plugin context, accepting an API-provided URL without allowlisting or integrity checks can expose users to untrusted content retrieval and disk abuse.

Content

Scanner excerpt · scripts/minimax.sh (reported line 296)May include surrounding context.

sh

-H "Authorization: Bearer $MINIMAX_API_KEY" \
      | python3 -c "import sys,json; print(json.load(sys.stdin).get('file',{}).get('download_url',''))" 2>/dev/null)
    filename="minimax-video-$(date +%Y%m%d-%H%M%S).mp4"
    curl -s -L "$url" -o "$MINIMAX_OUTPUT_DIR/$filename"
    log "视频已保存: $MINIMAX_OUTPUT_DIR/$filename"
  else
    err "视频生成失败或超时"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README explicitly instructs users to enter a MiniMax API key and states that the key will be automatically saved to ~/.openclaw/openclaw.json, but it does not warn about the security implications of storing a long-lived secret in a local configuration file. This can lead to accidental exposure through weak filesystem permissions, backups, dotfile syncing, or local compromise, especially because users may not realize the credential is being persisted.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.destructive_delete_command, suspicious.exposed_secret_literal

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: README.zh_CN.md:103

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: generate.sh:5