Minimax Token

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:22 PM UTC
• Version: 2.2.1

Overview

This skill needs review because it asks users to handle API and Telegram credentials and enable a persistent service, but the packaged artifact lacks the referenced code/service and gives weak safety guidance.

Install only if you are comfortable reviewing or supplying the missing script and service yourself. Prefer a virtual environment with pinned dependencies, store credentials outside shell history and command-line arguments, understand that Telegram notifications send data to a third party, and enable the systemd service only after confirming how to stop, disable, and remove it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 20
Vulnerability Type: Unpinned and unverifiable third-party dependency
Risk Level: Medium

Vulnerable Code:

bash

pip3 install requests

Technical Analysis

The installation instruction retrieves requests without a version constraint, cryptographic hash, lockfile, or explicitly trusted package index. Consequently, the component installed by this command can change over time without any corresponding change to the reviewed project.

If the package source, release process, package index, or dependency-resolution path is compromised, pip could retrieve an attacker-controlled distribution. Source distributions and build dependencies can execute code during package construction, while malicious package code could execute later when imported. The instruction also does not isolate the dependency in a virtual environment, potentially affecting the user's broader Python environment.

No malicious dependency is present in the audited artifact, and no active compromise was established. The finding concerns the unsafe and non-reproducible dependency installation procedure.

Attack Path

1. An attacker compromises a relevant package release, transitive dependency, package-index account, or dependency-resolution channel.
2. The user follows the documented pip3 install requests instruction.
3. Pip resolves the mutable, unpinned package version and downloads the compromised component.
4. Attacker-controlled code executes during package build/installation or when the installed library is subsequently imported.
5. The code operates with the permissions of the user running pip or the application.

Impact Assessment

Successful exploitation could provide code execution with the privileges of the installing or application user. Accessible scope may include that user's files, environment variables, API credentials, Python environment, and network acces ...[truncated 180 chars]

Remediation

View remediation

Remediation Suggestions

• Pin requests and all transitive dependencies to reviewed versions in a requirements or lock file.
• Generate and verify cryptographic hashes, then install with pip install --require-hashes -r requirements.txt.
• Use a dedicated virtual environment rather than the user's global Python environment.
• Configure an approved package index and require HTTPS certificate validation.
• Automate dependency vulnerability and integrity scanning.
• Establish a controlled process for reviewing and updating pinned versions.
• Document an installation sequence such as:

  bash

  python3 -m venv .venv
  . .venv/bin/activate
  python3 -m pip install --require-hashes -r requirements.txt
  

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:47

Finding

API Key Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 47-48
Vulnerability Type: Sensitive credential passed as a process argument
Risk Level: Medium

Vulnerable Code:

bash

# Method 2: Runtime argument
python3 minimax_token.py --check --api-key "your_api_key"

Technical Analysis

The documented invocation encourages users to place a MiniMax API key directly in a command-line argument. After substitution with a real key, the credential may be retained in shell history, terminal session recordings, command auditing systems, diagnostic output, automation logs, or process metadata.

Depending on operating-system process visibility and hardening, another local user or monitoring agent may be able to inspect command-line arguments while the process is active. Shell history can retain the credential beyond process termination. Quoting the value prevents shell word splitting but does not protect its confidentiality.

This guidance also conflicts with the document's security claim that sensitive configuration is read through environment variables. No hardcoded production key was found in the reviewed files, and exploitation requires a user to follow the unsafe command-line example with an actual credential.

Attack Path

1. A user replaces your_api_key with a valid MiniMax API key and executes the documented command.
2. The shell records the command in persistent history, or the argument becomes visible through process inspection, audit telemetry, terminal recording, or logs.
3. A local user, support operator, monitoring service, or attacker with access to those records retrieves the key.
4. The exposed key is used to authenticate to the MiniMax API outside the intended application.
5. The attacker consumes the associated quota or accesses API functions authorized for that credential until it is revoked or expires.

Impact Assessment

The direct impact is disclosure of the MiniMax API key. An ...[truncated 393 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the --api-key command-line example and avoid accepting secrets through process arguments.
• Prefer a protected environment file or configuration file readable only by the service account.
• Set restrictive permissions, such as mode 0600, on files containing credentials.
• For interactive use, read the key from a non-echoing prompt or operating-system credential store.
• For the user-level systemd service, use a protected EnvironmentFile or systemd credentials rather than embedding secrets in the unit or command line.
• Ensure the implementation never logs credentials and redacts sensitive values from exceptions and diagnostics.
• Document key rotation and immediate revocation procedures for credentials that may have appeared in shell history or logs.
• If environment variables are used, warn that they may still be exposed by process dumps or overly broad diagnostics and recommend a dedicated secret manager where available.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill explicitly uses a MiniMax API key and optional Telegram bot credentials, and it advertises Telegram notifications, but it does not clearly warn that status data and secrets are being used with third-party services or give handling precautions. This increases the risk of users exposing credentials in shell history, logs, screenshots, or unintentionally transmitting operational data through Telegram without understanding the privacy implications.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 81% confidence

Finding

The instructions tell users to enable a persistent user-level systemd service, which causes the monitoring process to run automatically across sessions. Persistence is not inherently malicious here, but in a skill that handles API keys and sends network notifications, auto-starting behavior can prolong credential exposure, generate unintended outbound traffic, and continue operating after the user forgets it was enabled.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md

cp minimax-token.service ~/.config/systemd/user/

# 启用服务
systemctl --user enable minimax-token
systemctl --user start minimax-token

# 查看日志

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README description is written in Chinese only, which indicates a language-specific experience without offering the user any language choice or opt-in. The policy requires avoiding forced language or locale constraints unless they are explicitly justified or optional.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.