ClawHub
Back to skill

Security audit

minimax-image

Security checks for vulnerabilities and agentic risk

Overview

This MiniMax image skill does what it claims: it generates or edits images through MiniMax and saves requested outputs locally.

Install only if you are comfortable providing a MiniMax API key and sending prompts or selected reference images to MiniMax. Avoid submitting sensitive images or confidential prompts, and save outputs in a dedicated folder to reduce accidental overwrites.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Low
Confidence
83% confidence
Finding
The skill advertises downloading and saving images locally but does not warn that local files may be created or overwritten. This can lead to unintended filesystem modification, especially if a caller provides unsafe or sensitive output paths.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill describes text-to-image and image-to-image features using a third-party API but omits a clear privacy warning that prompts, image URLs, and uploaded reference images may be transmitted to MiniMax. This is risky because users may unknowingly send sensitive text or local image content to an external service, creating confidentiality and compliance issues.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The documentation explicitly describes sending prompts and reference image URLs to a third-party image generation API, but it does not warn users that their content will leave the local environment or discuss privacy implications. In a skill that may handle user-supplied images and prompts, this can lead to inadvertent disclosure of sensitive or proprietary data.

Static analysis

No suspicious patterns detected.