Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Minimax Mcp

MiniMax MCP 服务器,提供网络搜索和图像理解能力。当用户需要:(1) 网络搜索信息,(2) 分析/描述图片,(3) 从URL提取内容时使用此技能。需配置 MINIMAX_API_KEY(国内版 api.minimaxi.com 或全球版 api.minimax.io)。

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 1.3k · 17 current installs · 17 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The SKILL.md declares needing MINIMAX_API_KEY, MINIMAX_API_HOST and the uvx binary, which make sense for an MCP server that calls the MiniMax API. However the top-level registry listing in the package metadata reported 'Required env vars: none' and 'Homepage: none', while SKILL.md includes required env vars and a GitHub link. This mismatch between declared registry requirements and the runtime instructions is an inconsistency that should be resolved.
Instruction Scope
Runtime instructions are narrowly scoped to configuring an MCP server, calling web_search and understand_image, and using local or remote image paths. They do instruct editing a local Claude/Cursor config file (user config path) and using local image files — these are expected for this skill. However the doc also recommends running a remote install script (curl ... | sh) for the 'uv' tool in troubleshooting, which broadens scope and is risky if done blindly.
Install Mechanism
There is no formal install spec in the registry (skill is instruction-only), but SKILL.md metadata suggests installing 'uv' (brew formula) and the troubleshooting text suggests running a remote installer from https://astral.sh/uv/install.sh via curl|sh. Brew is low-risk; piping an internet script to sh is higher-risk. Because the skill itself is only documentation/instructions (no code files), the main install risk comes from following those external install commands.
Credentials
Requesting MINIMAX_API_KEY and MINIMAX_API_HOST is proportionate to the described functionality (calling MiniMax web/image APIs). No other unrelated secrets are requested. Still, the registry summary omitted these env requirements while SKILL.md declares them — the mismatch should be clarified so users know what credentials are needed.
Persistence & Privilege
The skill does not request always:true or any elevated persistent presence. It does not modify other skills or system-wide settings in the instructions. The skill will rely on an external MCP server process (uvx + minimax-coding-plan-mcp) invoked by mcporter, which is normal for this capability.
What to consider before installing
This skill appears to genuinely implement a MiniMax MCP connector, but there are a few red flags to consider before installing: - Metadata mismatch: the registry summary says no required env vars/homepage but SKILL.md requires MINIMAX_API_KEY, MINIMAX_API_HOST and references a GitHub repo. Confirm the authoritative source (check the GitHub link in SKILL.md) and that the repo and binaries are legitimate. - Credentials: you must provide your MiniMax API key — only supply a key you control, and ensure the MINIMAX_API_HOST matches the region of the key. - External installer caution: the docs suggest running curl https://astral.sh/uv/install.sh | sh if uvx is missing. Do not run remote install scripts without inspecting them; prefer installing via a package manager (brew) or reviewing the install script source. - Local file access: the skill expects local image paths and editing of local app config files (e.g., Claude/Cursor config) — be mindful of what you store or expose in those configs. If you want higher confidence, ask the skill author for the exact upstream GitHub release and the checksums for the 'minimax-coding-plan-mcp' binary (or inspect that repository yourself) and verify the install script contents before running it.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.3
Download zip
latestvk97fth61y31f0at5wzdpvpjzh1812kes

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

MiniMax MCP Skill

Overview

Official MiniMax Model Context Protocol (MCP) server for coding-plan users, providing AI-powered search and vision analysis capabilities.

Features

ToolFunctionSupported Formats
web_searchWeb search with structured results (title, link, snippet)-
understand_imageAI image analysis and content recognitionJPEG, PNG, WebP

Trigger Scenarios

Use this skill when user says:

  • "Search for xxx" / "Look up xxx"
  • "Look at this image" / "Analyze this picture"
  • "What's in this image" / "Describe this photo"
  • "Extract content from URL" / "Fetch this webpage"

Quick Start

1. Get API Key

RegionAPI Key URLAPI Host
🇨🇳 Chinaplatform.minimaxi.comhttps://api.minimaxi.com
🇺🇳 Globalminimax.iohttps://api.minimax.io

2. Configure mcporter (Recommended)

# Add MCP server
mcporter config add minimax \
  --command "uvx minimax-coding-plan-mcp -y" \
  --env MINIMAX_API_KEY="your-key" \
  --env MINIMAX_API_HOST="https://api.minimaxi.com"

# Test connection
mcporter list

3. Direct Usage

# Search
mcporter call minimax.web_search query="keywords"

# Analyze image
mcporter call minimax.understand_image prompt="Describe this image" image_source="image-url-or-path"

Usage Examples

See references/examples.md

Environment Variables

VariableRequiredDescription
MINIMAX_API_KEYYour MiniMax API Key
MINIMAX_API_HOSTAPI endpoint

Important Notes

⚠️ API Key must match the host region!

RegionAPI Key SourceAPI Host
Globalminimax.iohttps://api.minimax.io
Chinaminimaxi.comhttps://api.minimaxi.com

If you get "Invalid API key" error, check if your Key and Host are from the same region.

Troubleshooting

  • "uvx not found": Install uv - brew install uv or curl -LsSf https://astral.sh/uv/install.sh | sh
  • "Invalid API key": Confirm API Key and Host are from the same region
  • Image download failed: Ensure image URL is publicly accessible, supports JPEG/PNG/WebP

Related Resources

Files

3 total
Select a file
Select a file to preview.

Comments

Loading comments…