Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

MiniMax MCP Tools

v1.0.0

提供联网搜索和图片内容理解服务,支持关键词搜索和基于描述请求的图片分析。

0· 107·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for hongjiahao371-pixel/minimax-mcp-tools.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "MiniMax MCP Tools" (hongjiahao371-pixel/minimax-mcp-tools) from ClawHub.
Skill page: https://clawhub.ai/hongjiahao371-pixel/minimax-mcp-tools
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install minimax-mcp-tools

ClawHub CLI

Package manager switcher

npx clawhub@latest install minimax-mcp-tools
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
Purpose & Capability
The described capabilities (web_search and understand_image) match the SKILL.md instructions: the skill uses a local MCP bridge (uvx) and a MiniMax API. However the skill metadata declares no required environment variables or primary credential while the SKILL.md explicitly requires a MINIMAX_API_KEY and MINIMAX_API_HOST in ~/.openclaw/mcp.json. That mismatch is unexpected and should have been reflected in the registry metadata.
!
Instruction Scope
The runtime instructions tell the user/agent to install uvx via a remote installer (curl -LsSf https://astral.sh/uv/install.sh | sh), to edit ~/.openclaw/mcp.json to add an API key and host, and to allow reading local image file paths for image analysis. Installing and running a remote install script and placing API keys in a local config are reasonable for this tool but expand scope beyond simple guidance; the remote installer step is high-risk if the domain/script is not verified. The SKILL.md also omits explicit guidance about safe handling of the API key (no mention of least-privilege keys or secret storage).
!
Install Mechanism
This is an instruction-only skill, so there is no automated install spec, but the documentation instructs running a curl | sh installer from https://astral.sh — a third-party URL. The evaluator cannot verify that URL or script contents; running such installers without review is risky. The rest of the installation (editing mcp.json, clawhub install minimax-mcp) references commands whose origin isn't documented; users should confirm those packages' provenance before running them.
!
Credentials
Metadata lists no required env vars or primary credential, yet SKILL.md instructs storing MINIMAX_API_KEY and MINIMAX_API_HOST in the MCP config. The need for a single API key is expected for this service, but it should be declared in metadata. There are no unrelated credentials requested, and local image file access is justified by the feature, but the missing declaration of the API key is an inconsistency that affects trust and automated permission checks.
Persistence & Privilege
The skill does not request always:true and does not request system-wide privileges. It asks the user to add an entry to the user's ~/.openclaw/mcp.json and to restart the OpenClaw gateway — standard for adding an MCP plugin. There is no request to modify other skills' configs or global system settings in the instructions.
What to consider before installing
Before installing: (1) Confirm the MiniMax service and domain (https://platform.minimaxi.com and https://api.minimaxi.com) are legitimate and trustworthy. (2) Do NOT run curl | sh against https://astral.sh without inspecting the script first — download and review the installer contents locally, or obtain uvx from an official package repository. (3) Verify the provenance of the 'clawhub install minimax-mcp' package (who publishes it, is it signed?). (4) Treat the MINIMAX_API_KEY as a secret: create a least-privilege token if the service supports it, and store it in your platform's secret store rather than embedding it in plain text if possible. (5) Be aware the skill will read local image files you point it at; only supply images you are willing to transmit to the MiniMax API. (6) Ask the publisher for a homepage or source repository if you need more assurance — the registry metadata currently lacks links or author details.

Like a lobster shell, security has layers — review code before you run it.

latestvk97cpveqfdrbsyg83hb3cz5mss83dk3g
107downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

MiniMax MCP - 联网搜索 & 图片理解

功能简介

MiniMax 官方 MCP 服务,提供联网搜索图片理解两大功能。

工具列表

工具功能参数
web_search联网搜索query: 搜索关键词
understand_image图片理解prompt: 图片描述要求, image_url: 图片URL或本地路径

前置要求

  1. 安装 uvx(如果未安装):
# macOS/Linux
curl -LsSf https://astral.sh/uv/install.sh | sh

# 验证安装
which uvx
  1. 获取 MiniMax API Key

安装配置

1. 安装 Skill

clawhub install minimax-mcp

2. 配置 MCP

编辑 ~/.openclaw/mcp.json,添加 MiniMax MCP 配置:

{
  "mcpServers": {
    "MiniMax": {
      "command": "/Users/js/.local/bin/uvx",
      "args": ["minimax-coding-plan-mcp", "-y"],
      "env": {
        "MINIMAX_API_KEY": "你的API_Key",
        "MINIMAX_API_HOST": "https://api.minimaxi.com"
      }
    }
  }
}

注意:Windows 用户请将 uvx 路径改为 uvx.exe 或对应路径

3. 重启 OpenClaw

openclaw gateway restart

4. 验证 MCP 加载

mcporter list
# 应该看到 minimax (2 tools) - healthy

使用方法

联网搜索

mcporter call minimax.web_search query="搜索关键词"

示例:

mcporter call minimax.web_search query="OpenClaw AI助手"

图片理解

mcporter call minimax.understand_image prompt="描述要求" image_url="图片URL或本地路径"

示例:

mcporter call minimax.understand_image prompt="这张图片里有什么?" image_url="https://example.com/image.jpg"

OpenClaw 中的使用方法

在 OpenClaw 会话中,直接让 AI 帮你搜索或分析图片即可,AI 会自动调用 MCP 工具。

示例对话

  • "帮我搜索 XXX"
  • "帮我分析这张图片"(发送图片)

费用说明

常见问题

Q: mcporter list 看不到 minimax?

检查 MCP 配置是否正确,重启 OpenClaw 网关。

Q: 图片理解失败?

  • 检查图片 URL 是否可访问
  • 本地文件路径需保证路径存在且有读取权限
  • 支持格式:JPEG、PNG、GIF、WebP(最大 20MB)

Q: 搜索结果为空?

检查 API Key 是否有效,是否有额度。

更新日志

v1.0.0 (2026-03-22)

  • 初始版本
  • 支持 web_search 联网搜索
  • 支持 understand_image 图片理解

Comments

Loading comments...