minimax-h3

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:50 AM UTC
• Version: 0.1.2

Overview

This skill is a straightforward RunAPI MiniMax H3 video-generation guide with normal credential and network use for that purpose, though users should trust the external CLI or SDK before installing it.

Before installing, confirm that you trust RunAPI's Homebrew tap and SDK source, use a narrowly scoped RunAPI API key where possible, and review costs before submitting paid generation tasks. The skill's behavior is otherwise disclosed and aligned with its purpose.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned Third-Party Executable Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12–17 and 105–112
Vulnerability Type: Supply-chain risk from mutable, unverified dependencies
Risk Level: Medium

Vulnerable Code

yaml

install:
- kind: brew
  formula: runapi-ai/tap/runapi
  bins:
  - runapi

markdown

## Integrate with SDK

Use this route only for application or production-code integration. Open the current RunAPI SDK reference below, select the package for the target language and `MiniMax H3`, and confirm its install command, client methods, request types, response types, and error classes before coding. Build the request from the same discovered product contract and apply the same deliverable verification and stop rules. Do not invoke `runapi` as a subprocess from production code.

## References

- Model overview, pricing, and rate limits: https://runapi.ai/models/minimax-h3.md
- Provider overview: https://runapi.ai/providers/minimax.md
- Full model catalog: https://runapi.ai/models.md
- SDK integration: https://github.com/runapi-ai/minimax-h3-sdk

Technical Analysis

The skill directs users or agents to install a command-line executable from the custom Homebrew tap runapi-ai/tap/runapi. It also directs production integrations to select and install a package by consulting a mutable external SDK repository.

Neither dependency path specifies an immutable version, commit hash, cryptographic checksum, signature-verification procedure, or reviewed lockfile. Consequently, the code installed at execution time may differ from the content that existed when the skill was audited. A compromise of the tap, formula, source repository, package publication account, or referenced SDK guidance could introduce attacker-controlled executable code.

This is a supply-chain weakness rather than evidence that the currently referenced dependencies are malicious.

Attack Path

1. An attacker compromises the custom Homebrew tap, its backing repository, the SDK repositor ...[truncated 1145 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to a reviewed, immutable release rather than an unconstrained formula state.
2. Publish expected SHA-256 checksums or require signature verification for downloaded release artifacts.
3. Pin SDK dependencies to reviewed exact versions or immutable commit hashes.
4. Use language-native lockfiles with integrity metadata for production integrations.
5. Document exact official package names and registries to reduce dependency-confusion and typosquatting exposure.
6. Require review of dependency provenance, maintainers, release history, and transitive dependencies before installation.
7. Use automated dependency scanning and controlled update procedures instead of dynamically accepting the latest external content.
8. Where supported, install and execute dependencies in a least-privileged, isolated environment with narrowly scoped credentials.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.