Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

minimax-tokenplan-image-generation

v0.9.5

Generate images using MiniMax image-01 model. Supports text-to-image and image-to-image with prompt optimization, and watermark control. Preferred skill for...

0· 125·0 current·0 all-time
byk.x.@4833675

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for 4833675/minimax-tokenplan-image-generation.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "minimax-tokenplan-image-generation" (4833675/minimax-tokenplan-image-generation) from ClawHub.
Skill page: https://clawhub.ai/4833675/minimax-tokenplan-image-generation
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: MINIMAX_API_KEY
Required binaries: python3
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install minimax-tokenplan-image-generation

ClawHub CLI

Package manager switcher

npx clawhub@latest install minimax-tokenplan-image-generation
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (image generation using MiniMax image-01) match the included script and instructions. However the registry/SKILL.md requires MINIMAX_API_KEY as an environment variable while the shipped script does not read that env var (it expects you to embed the key in a top-of-file constant or pass --api-key). This mismatch between declared requirements and actual usage is surprising and unnecessary.
!
Instruction Scope
Runtime instructions ask the user to edit scripts/generate.py to insert the API key and base URL, then delete the init section. The script reads local image files (if provided) and converts them to base64 and sends them to the remote API — expected for image-to-image, but this behavior will transmit arbitrary local image contents to an external service. The SKILL.md otherwise stays within the stated purpose and does not instruct reading unrelated files or secrets, but the manual-edit flow increases the chance a user will embed a secret in source on disk.
!
Install Mechanism
Registry metadata says no install spec, but SKILL.md contains an 'install' metadata entry pointing to https://clawhub.ai/skills/minimax-tokenplan-image-generation. That URL is not a standard release host (GitHub/releases) and could be used to host arbitrary archives if followed. The package itself is instruction-only with a local Python script and requires pip installing 'requests' only. If you rely on the SKILL.md install link, treat it as an external download from a third-party domain and verify its contents before running.
!
Credentials
Only one credential is requested (MINIMAX_API_KEY), which is appropriate for this API integration. But the script does not actually read MINIMAX_API_KEY from the environment — it expects either the top-of-file API_KEY constant to be edited or --api-key on invocation. Declaring an env var requirement that is not used is an inconsistency and could mislead users. No other unrelated credentials are requested.
Persistence & Privilege
The skill does not request always:true and does not modify other skills. It writes generated files to a shared directory (~/.openclaw/media/minimax/) by default — this is expected for output storage but may leak outputs across agents. Filesystem write and network access are required for its function; consider changing the default output directory if you want per-agent isolation.
What to consider before installing
What to consider before installing: - The script is a straightforward wrapper for a remote MiniMax image API and needs a MiniMax API key. Prefer passing the key at runtime (--api-key) or modify the script to read MINIMAX_API_KEY from the environment (os.environ) rather than embedding the key directly in the file. - Image-to-image mode will read local files and upload them (converted to base64) to the remote API — only use it with images you are comfortable sending to an external service. - The SKILL.md includes an install/download URL on clawhub.ai; the registry itself has no install spec. Do not download or run archives from that URL without inspecting them. If you need to install anything, only pip install the well-known requests package. - The script writes outputs to ~/.openclaw/media/minimax/ (shared among agents). If that is sensitive, change OUTPUT_DIR in the script before running. - The declared required env var (MINIMAX_API_KEY) is inconsistent with the shipped code — verify how your agent will supply the key (env vs file edit vs CLI). Prefer environment-based injection over editing source files. - If you want more assurance: open and review scripts/generate.py yourself (it is short and readable), verify the API base URLs and TLS, and test with a non-sensitive key or dummy image first. Given these mismatches and privacy tradeoffs (local file upload & a third-party install link mentioned), treat the skill as plausible but verify the points above before use.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🎨 Clawdis
OSmacOS · Linux · Windows
Binspython3
EnvMINIMAX_API_KEY
latestvk9742nt9zkb4q4259p7q8aw5eh849gvq
125downloads
0stars
2versions
Updated 3w ago
v0.9.5
MIT-0
macOS, Linux, Windows

MiniMax Image Generation Skill

前置条件

  • Python 3 已安装
  • requests 库pip3 install requests

init

需要初始化以下信息:

第一步:获取 API Key

向用户获取 MiniMax API Key(sk-cp- 开头的 Token Plan key,或普通 API Key)。

第二步:确认配置

向用户确认:

  • API Key 是否正确
  • 使用哪个区域:
    • CNapi.minimaxi.com(中国版,支持 image-01 + image-01-live)
    • Globalapi.minimaxi.io(国际版,仅支持 image-01)

第三步:填写配置

获取以上信息后:

  1. 修改 scripts/generate.py 顶部的配置常量(API_KEYBASE_URLREGION),填入实际值
  2. 同时更新下方 ## 配置 区段的表格,作为配置记录

第四步:清理

配置填写完成后,删除本 ## init 区段(包括 ### 需要初始化以下信息 的全部内容),仅保留 ## 配置 区段


配置

注意

  • Global(api.minimaxi.io)仅支持 image-01 模型,不支持 image-01-live
  • CN(api.minimaxi.com)支持 image-01image-01-live
配置项说明
MINIMAX_API_KEY<待填入>初始化时替换为实际 key
BASE_URL<待填入>CN: https://api.minimaxi.com / Global: https://api.minimaxi.io

快速使用

1️⃣ 文生图(Text-to-Image)

SKILL_DIR="~/.openclaw/workspace/skills/minimax-tokenplan-image-generation"
python3 "$SKILL_DIR/scripts/generate.py" \
    --prompt "你的图片描述" \
    --aspect-ratio "16:9"

注意:以下示例中 generate.py 均指 ~/.openclaw/workspace/skills/minimax-tokenplan-image-generation/scripts/generate.py 的完整路径。

参数说明:

参数必填说明默认值
--prompt图片描述,最长 1500 字符,超出会报错-
--aspect-ratio宽高比16:9
--output输出路径自动生成
--n生成数量(最大9)1
--api-keyAPI Key(默认使用文件顶部配置)-
--base-urlBase URL(默认使用文件顶部配置)-
--response-format返回格式:base64(保存图片)或 url(返回链接,24小时有效)base64

aspect_ratio 可选值: 16:9 / 9:16 / 1:1 / 3:2 / 2:3

示例:

# 生成16:9风景图
python3 generate.py --prompt "日出时分雪山倒映在湖面,温暖的金色光线" --aspect-ratio "16:9"

# 生成9:16竖版人像
python3 generate.py --prompt "未来风格的城市夜景,赛博朋克" --aspect-ratio "9:16"

2️⃣ 图生图(Image-to-Image)

在文生图基础上,添加 --image-url 参数传入参考图:

python3 "$SKILL_DIR/scripts/generate.py" \
    --prompt "新的图片描述" \
    --image-url "/path/to/reference.jpg" \
    --aspect-ratio "9:16"

--image-url 支持两种格式:

  1. 公网 URL(直接使用,无需下载)

    --image-url "https://example.com/image.jpg"
    

    如果是 http://https:// 开头,直接传递给模型,不做下载和转换。

  2. 本地文件路径(转为 base64)

    --image-url "/path/to/reference.jpg"
    

    脚本会自动读取本地文件并转为 base64 Data URL 发送给 API。

图生图规则:

  • type 固定为 "character"(保持人物/主体特征)
  • 最多 1 张参考图
  • 图片大小限制:小于 10MB

示例:

# 以本地图片为参考(推荐方式)
python3 generate.py \
    --prompt "机械外骨骼大龙虾,在太空中战斗" \
    --image-url "/path/to/my-lobster.jpg" \
    --aspect-ratio "9:16"

工作流总结

图生图完整流程

  1. 用户提供参考图片
  2. 脚本自动处理 → 读取图片 → 转为 base64 Data URL
  3. 调用 API → subject_reference 传入 base64 数据
  4. 生成新图 → 返回图片 URL 或 base64

Prompt 处理规则

不传 --prompt-optimizer / --no-prompt-optimizer 时,脚本会自动判断(阈值:40 字符):

情况处理方式
prompt < 40 字符(短描述)脚本自动开启 prompt_optimizer,丰富描述细节
prompt ≥ 40 字符(长描述)脚本自动关闭 prompt_optimizer,保留用户原意
用户明确说「不要改prompt」/「保持原样」--no-prompt-optimizer,强制关闭
用户明确要求优化 prompt--prompt-optimizer,强制开启
用户要求多张设置 --n 4(最大9)

水印规则

情况处理方式
默认aigc_watermark: false
prompt 含「水印/版权/标识/logo/watermark/copyright」等关键词aigc_watermark: true 自动开启

response_format 规则

情况处理方式
默认使用 base64,脚本自动解码保存 PNG
用户明确要求"返回链接"、"返回URL"、"给我网络地址"等--response-format url(返回 URL,注意:链接有效期仅24小时

示例:

# 要求返回网络链接
python3 generate.py --prompt "大龙虾在太空中战斗" --response-format url
# 输出:https://...
# 注意:返回的 URL 只有 24 小时有效期

文件存储

  • 默认保存到~/.openclaw/media/minimax/(多 Agent 共享目录)
  • 文件名格式minimax-YYYY-MM-DD-<prompt_slug>.png
  • prompt_slug:取 prompt 关键词,英文前6词 + 中文前3词,空格变 -

脚本输出格式

调用 generate.py 后,stdout 输出生成结果,格式如下:

response_formatstdout 输出示例
base64(默认)保存后的文件绝对路径/Users/x/.openclaw/media/minimax/minimax-2026-03-27-sunset.png
url图片的公网 URL(24小时有效)https://filecdn.minimax.chat/...
多张图片(--n 2+| 分隔path1.png | path2.png

所有日志信息([INFO][WARN][ERROR])输出到 stderr,不会混入 stdout。


错误处理

code含义处理
0成功继续
1002限流提醒用户 API 限流中,建议稍后重试
1004鉴权失败检查 API Key
1008余额不足提醒充值
1026敏感词换词后重试
2013参数异常检查入参(可能是 URL 格式不对)
2049无效 Key检查 Key 是否正确

Comments

Loading comments...