Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Minimax Coding Plan Tool

v1.0.4

MiniMax Token Plan工具 - 支持图片生成、图像理解、语音合成和视频生成。直接调用MiniMax官方API,纯JavaScript实现,无需外部MCP服务器。

0· 98·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for yongjie666888/minimax-coding-plan-tool-yongjie.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Minimax Coding Plan Tool" (yongjie666888/minimax-coding-plan-tool-yongjie) from ClawHub.
Skill page: https://clawhub.ai/yongjie666888/minimax-coding-plan-tool-yongjie
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: MINIMAX_API_KEY
Required binaries: node
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install minimax-coding-plan-tool-yongjie

ClawHub CLI

Package manager switcher

npx clawhub@latest install minimax-coding-plan-tool-yongjie
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The SKILL.md advertises five features (image gen, image understanding, TTS, video generation, web search) but the shipped code only implements web_search, understand_image, and generate_image. The README/header even claims the tool provides only two tools in places — inconsistent claims about capabilities. Required binary (node) and declared env MINIMAX_API_KEY match the implemented code, but the declared scope in the doc (speech/video) is not implemented in code, which is misleading.
!
Instruction Scope
The runtime instructions explicitly tell users to supply an OpenClaw OAuth token (sk-cp-...) as the API key and show a full 'openclaw config set' example with a long sk-cp token. The code will send that token in an Authorization header to api.minimaxi.com. The tool reads local image files (converts to base64) and will POST that data to the external API — this is expected for image analysis, but it also enables exfiltration of any local file with a supported image extension (an attacker could rename sensitive files to have .png etc.). The SKILL.md and code do not instruct reading other unrelated system paths, but the explicit guidance to use a platform OAuth token is sensitive and risky.
Install Mechanism
There is no install script or remote download — this is an instruction-only skill with a single JS file. Required runtime is node. No external installers or archives are fetched by the skill itself.
!
Credentials
The skill requires a single env var MINIMAX_API_KEY (declared primary credential). However the documentation instructs using the user's OpenClaw OAuth token (sk-cp-...), which is a highly privileged platform credential. It's unclear whether a platform OAuth token is necessary or whether a separate MiniMax-specific API key could be used. Requesting that platform token and sending it to an external host is disproportionate unless Token Plan truly requires it. Additionally, the SKILL.md includes a hardcoded example token string, which is poor practice and potentially sensitive.
Persistence & Privilege
The skill does not request 'always: true' and does not appear to modify other skills or system-wide settings. It only requires the API key at runtime and will run as a normal user process.
What to consider before installing
This skill is inconsistent and requires caution. What to consider before installing or using it: - The documentation asks you to provide an OpenClaw OAuth token (sk-cp-...) and the code will send that token to api.minimaxi.com. Treat that token as highly sensitive; do not supply your platform OAuth token unless you explicitly trust the author and have confirmed that the Token Plan really requires platform tokens. - The SKILL.md advertises TTS and video features that are not implemented in the included code. Ask the author why those features are missing or whether you were given the correct release. - The tool will read local image files and convert them to base64 for upload. Do not point it at any files that contain secrets or sensitive data (you could accidentally exfiltrate credentials if you rename them to an image extension). - Metadata mismatches: the embedded _meta.json ownerId/version differ from the registry metadata — this can indicate repackaging or stale metadata. Verify the skill's author and origin before use. - If you want to test safely: run the code in a network-restricted sandbox and inspect outbound requests (ensure it only calls the intended api.minimaxi.com endpoints). Prefer creating a limited/minimally-privileged API key (not your main OpenClaw OAuth token) if the service supports it. - If you cannot confirm provenance or necessity of using an sk-cp token, do not provide your platform OAuth token; ask the publisher to provide an official MiniMax-specific API key flow or a privacy justification.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🧩 Clawdis
Binsnode
EnvMINIMAX_API_KEY
Primary envMINIMAX_API_KEY
latestvk97a3rgfftzps8mjn7zkbb5b2s83ga9q
98downloads
0stars
1versions
Updated 1mo ago
v1.0.4
MIT-0

MiniMax Coding Plan Tool

⚠️ 使用你的 OpenClaw OAuth Token(sk-cp- 开头)作为 API Key 来自 MiniMax Token Plan 订阅额度

MiniMax Token Plan 工具,支持:

  • 图片生成(image-01模型,200张/日)
  • 图像理解(VLM模型)
  • 语音合成(speech-2.8-hd模型)
  • 视频生成(MiniMax-Hailuo-2.3模型)
  • 网页搜索

纯 JavaScript 实现,直接调用 MiniMax 官方 API,无需外部 MCP 服务器。


✨ Features

1. minimax_generate_image

图片生成,使用 MiniMax image-01 模型。每日200张额度。

2. minimax_web_search

网页搜索,使用 MiniMax 搜索 API。

3. minimax_understand_image

图像理解,使用 MiniMax VLM 模型分析图片内容。

4. minimax_text_to_speech

语音合成,使用 MiniMax speech-2.8-hd 模型。支持英语发音,可调节语速。

5. minimax_generate_video

视频生成,使用 MiniMax-Hailuo-2.3 模型。异步生成,返回 task_id 用于查询进度。


🧩 Architecture

  • 纯 JavaScript 实现
  • 直接 HTTPS API 调用
  • 无需 MCP 服务器
  • 无需外部工具依赖

🔑 Configuration

API Key 使用你的 OpenClaw OAuth Token:

openclaw config set skills.entries.minimax-coding-plan-tool.apiKey "sk-cp-gr3tv5pdbN3aPQRhXbREJQrHymKxPZhdn9mdS2Ak9B2uD39bKTTJyRJhBdLRjWrd2KbkEFV8-Zd03HgRkJwCTbLq3NYtmAzZ6U2C2Dfb35o5g89RoDBLBv8"

Tool 1 — minimax_generate_image

Purpose

图片生成。使用 MiniMax image-01 模型,通过 Token Plan API 调用。额度:每日200张。

CLI Invocation

MINIMAX_API_KEY="sk-cp-..." node minimax_coding_plan_tool.js generate_image "描述词"

Input Schema

{
  "prompt": "string"
}

Output Format

{
  "success": true,
  "prompt": "a blue robot",
  "image_urls": ["https://..."],
  "job_id": "..."
}

Tool 2 — minimax_web_search

Purpose

实时网页搜索,使用 MiniMax 搜索 API。

CLI Invocation

MINIMAX_API_KEY="sk-cp-..." node minimax_coding_plan_tool.js web_search "查询词"

Input Schema

{
  "query": "string"
}

Output Format

{
  "success": true,
  "query": "...",
  "results": [
    { "title": "...", "link": "...", "snippet": "...", "date": "..." }
  ]
}

Tool 3 — minimax_understand_image

Purpose

图像理解,使用 MiniMax VLM API 分析图片内容。支持 JPEG/PNG/WebP/GIF。

CLI Invocation

MINIMAX_API_KEY="sk-cp-..." node minimax_coding_plan_tool.js understand_image @photo.png "描述这张图"

Input Schema

{
  "image_source": "string",
  "prompt": "string"
}

Output Format

{
  "success": true,
  "prompt": "...",
  "image_source": "...",
  "analysis": "model response"
}

Tool 4 — minimax_text_to_speech

Purpose

语音合成,使用 MiniMax speech-2.8-hd 模型,通过 Token Plan API 调用。支持英语等多种语言。

CLI Invocation

MINIMAX_API_KEY="sk-cp-..." node minimax_coding_plan_tool.js text_to_speech "Hello, welcome to MiniMax"

Input Schema

{
  "text": "string",
  "voice_id": "string (optional, default: English_expressive_narrator)",
  "speed": "number (optional, default: 1.0)"
}

Available Voice IDs

voice_idDescription
English_expressive_narratorExpressive English narrator
English_expressiveExpressive English
English_guyAmerican male voice
English_womanAmerican female voice
British_manBritish male voice
Chinese_CN_femaleChinese female voice

Output Format

{
  "success": true,
  "text": "Hello, welcome to MiniMax",
  "audio": "base64_encoded_audio_data",
  "audio_format": "mp3",
  "audio_length_ms": 2700,
  "job_id": "..."
}

Tool 5 — minimax_generate_video

Purpose

视频生成,使用 MiniMax MiniMax-Hailuo-2.3 模型,通过 Token Plan API 调用。异步生成,返回 task_id。

CLI Invocation

MINIMAX_API_KEY="sk-cp-..." node minimax_coding_plan_tool.js generate_video "a robot walking"

Input Schema

{
  "prompt": "string",
  "duration": "number (optional, 6 or 10 seconds, default: 6)",
  "resolution": "string (optional, '720P' or '1080P', default: '1080P')"
}

Output Format

{
  "success": true,
  "prompt": "a robot walking",
  "task_id": "380141647249520",
  "status": "pending"
}

⚠️ 注意

视频生成是异步的,需要等待完成后通过 task_id 查询结果。查询接口在 api.minimaxi.com 上返回 404,Token Plan 可能不支持视频进度查询,视频 URL 直接在生成完成后通过其他渠道获取。

Comments

Loading comments...