Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

MiniMax Video Generator

v1.0.0

Generate videos using MiniMax by uploading start/end frames or describing scenes, then query status and download results.

0· 217·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for hongjiahao371-pixel/minimax-video-gen.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "MiniMax Video Generator" (hongjiahao371-pixel/minimax-video-gen) from ClawHub.
Skill page: https://clawhub.ai/hongjiahao371-pixel/minimax-video-gen
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install minimax-video-gen

ClawHub CLI

Package manager switcher

npx clawhub@latest install minimax-video-gen
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
Name/description match the code: scripts call a MiniMax API to generate, query, and download videos. However the registry metadata claimed no required config or credentials while both SKILL.md and all three scripts explicitly read an API key from ~/.openclaw/openclaw.json — the skill will not work without that key and the manifest failed to declare this requirement.
Instruction Scope
SKILL.md and the scripts are narrowly scoped to (1) read a MiniMax apiKey from ~/.openclaw/openclaw.json, (2) POST to /v1/video_generation, GET to /v1/query/video_generation and /v1/files/retrieve, and (3) download a file to a local path. The scripts do not attempt to read other system files or call arbitrary endpoints, but they do read the user's OpenClaw config file (which may contain other provider entries) to extract the apiKey.
Install Mechanism
This is an instruction-only skill with included scripts and no install spec. Nothing will be downloaded or written to system locations by an automated installer; the scripts run locally when invoked.
!
Credentials
The skill requires an API key but the registry metadata lists no required env vars or config paths. Instead the code reads ~/.openclaw/openclaw.json to find minimax-cn.apiKey. This mismatch (undeclared credential/config dependency) is the main proportionality issue. The scripts only use a single provider key (minimax-cn) and do not explicitly exfiltrate other credentials, but they do parse your OpenClaw config file to obtain it.
Persistence & Privilege
The skill does not request permanent/always-on installation, does not modify other skills or system-wide settings, and does not persist new credentials. It simply reads the OpenClaw config and performs network calls when run.
What to consider before installing
Before installing or running this skill: (1) know that the scripts will read ~/.openclaw/openclaw.json to obtain a minimax-cn apiKey even though the registry metadata didn’t declare this — ensure that file contains only the key you intend to use (create a dedicated MiniMax key if possible). (2) Network activity: the scripts will send that API key in an Authorization: Bearer header to api.minimaxi.com and will download remote files (the download script follows redirects). Verify you trust the MiniMax endpoints and the source of any file URLs. (3) Review output paths before downloading to avoid overwriting important files. (4) If you want stricter control, set a dedicated config with only the MiniMax apiKey or modify the scripts to accept an explicit env var/API key rather than reading the shared OpenClaw config. (5) The skill’s manifest should have declared the config dependency — consider asking the author to update metadata and documentation for transparency.

Like a lobster shell, security has layers — review code before you run it.

latestvk970vtm8fr00eg4nq9snsywstx83aeha
217downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

MiniMax 视频生成技能

使用 MiniMax Hailuo 生成视频,支持首尾帧模式(首图→尾图)和文生视频模式。

功能

  1. 首尾帧生成视频 - 上传首帧和尾帧图片,生成过渡视频
  2. 文生视频 - 根据文本描述生成视频
  3. 查询任务状态 - 查询视频生成进度
  4. 下载视频 - 获取视频下载链接并下载到本地

前置准备

API Key 配置

API Key 存储在 ~/.openclaw/openclaw.json 中,路径为:

{
  "models": {
    "providers": {
      "minimax-cn": {
        "apiKey": "your-api-key-here",
        "baseUrl": "https://api.minimaxi.com/anthropic"
      }
    }
  }
}

脚本会自动从配置文件中读取 API Key。

使用方式

首尾帧模式生成视频

cd ~/.openclaw/workspace/skills/minimax-video
node scripts/generate.js --mode fl2v \
  --first-frame "https://example.com/first.jpg" \
  --last-frame "https://example.com/last.jpg" \
  --prompt "A little girl grow up." \
  --model MiniMax-Hailuo-02 \
  --duration 6 \
  --resolution 1080P

文生视频模式

cd ~/.openclaw/workspace/skills/minimax-video
node scripts/generate.js --mode t2v \
  --prompt "A cute cat playing with a ball of yarn" \
  --model MiniMax-Hailuo-2.3 \
  --duration 6 \
  --resolution 1080P

查询任务状态

node scripts/query.js --task-id <task_id>

下载视频

node scripts/download.js --file-id <file_id> --output ./output.mp4

API 文档

  • 生成视频: POST https://api.minimaxi.com/v1/video_generation
  • 查询状态: GET https://api.minimaxi.com/v1/query/video_generation?task_id=xxx
  • 获取下载链接: GET https://api.minimaxi.com/v1/files/retrieve?file_id=xxx

模型说明

模型说明推荐用途
MiniMax-Hailuo-02首尾帧模式图片转视频
MiniMax-Hailuo-2.3文生视频/图生视频文字/图片生成视频
MiniMax-Hailuo-2.3-Fast快速版本快速生成

注意事项

  • 下载链接有效期 1小时,超时需重新获取
  • Token Plan 视频配额每日重置:
    • Plus-极速版: 3个/日
    • Max-极速版: 5个/日
    • Ultra-极速版: 5个/日

文件结构

minimax-video/
├── SKILL.md           # 本文档
└── scripts/
    ├── generate.js    # 生成视频主脚本
    ├── query.js       # 查询任务状态
    └── download.js    # 下载视频

Comments

Loading comments...