Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

MiniMax Vision Analysis

Analyze, describe, and extract information from images using the MiniMax vision MCP tool. Use when: user shares an image file path or URL (any message contai...

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 0 · 0 current installs · 0 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill claims to call a MiniMax MCP tool for image analysis and the SKILL.md provides mode-specific prompts and configuration instructions consistent with that purpose. However, the runtime instructions require a MiniMax Token Plan and MINIMAX_API_KEY / MINIMAX_API_HOST, but the registry metadata lists no required environment variables or primary credential — this is an inconsistency between claimed requirements and declared metadata.
!
Instruction Scope
The SKILL.md instructs the agent to auto-trigger on any message with various image file extensions or many image-related keywords, which is broad and may cause unexpected or unwanted invocations. It also tells the agent to "detect the user's environment" and emit exact MCP setup commands for different platforms — the detection step is vague and could lead to reading environment/system details if implemented, but the file does not explicitly constrain what may be read.
Install Mechanism
This is an instruction-only skill with no install spec and no code files, so nothing will be written or downloaded during install. That lowers the attack surface; the SKILL.md points to an external docs URL for guidance but does not cause arbitrary code execution by itself.
!
Credentials
The instructions clearly require MINIMAX_API_KEY and MINIMAX_API_HOST and state a paid Token Plan is required, yet the skill registry lists no required environment variables or primary credential. Requesting a service API key for a vision tool is reasonable, but the omission in metadata is a mismatch that could hide credential requirements. The skill also mentions local file access via MCP if configured — users should be aware this enables reading local image files when set up.
Persistence & Privilege
The skill does not request permanent/always-on status, does not modify other skills' configs, and has no install-time hooks. Autonomous invocation is allowed by platform default (disable-model-invocation: false) but that is normal; nothing in the skill requests elevated persistence privileges.
Scan Findings in Context
[no_code_files_to_scan] expected: The regex-based scanner had nothing to analyze because this is an instruction-only skill (only SKILL.md present). Absence of scan findings is expected but does not guarantee the SKILL.md is safe or coherent.
What to consider before installing
This skill appears to be a wrapper for a paid MiniMax image-analysis tool and the SKILL.md instructs how to configure an MCP with MINIMAX_API_KEY and MINIMAX_API_HOST. Before installing: (1) confirm you actually have a MiniMax Token Plan and are willing to provide the MINIMAX_API_KEY to the agent, (2) ask the publisher to add the required env vars to the registry metadata (currently none are declared), (3) be aware the skill auto-triggers on many image-related keywords and extensions — if you don’t want automatic analysis, avoid enabling or request a less-broad trigger, (4) note that MCP configuration can grant local file access to images, so only proceed if you trust the source and understand where image data will be sent, and (5) if you cannot verify the MiniMax service URL or publisher, do not install. If you want me to, I can draft a short checklist or a safer SKILL.md change request to send to the skill author (e.g., declare required env vars, narrow triggers, and clarify what environment detection does).

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.0
Download zip
analysisvk9786gevdv0c63np8p6te6sgex83y1jwimagevk9786gevdv0c63np8p6te6sgex83y1jwlatestvk9786gevdv0c63np8p6te6sgex83y1jwmediavk9786gevdv0c63np8p6te6sgex83y1jwminimaxvk9786gevdv0c63np8p6te6sgex83y1jwocrvk9786gevdv0c63np8p6te6sgex83y1jwofficialvk9786gevdv0c63np8p6te6sgex83y1jwvisionvk9786gevdv0c63np8p6te6sgex83y1jw

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Vision Analysis

Analyze images using the MiniMax MiniMax_understand_image MCP tool available in the MiniMax Token Plan.

Prerequisites

  • MiniMax Token Plan subscription with valid MINIMAX_API_KEY
  • MiniMax MCP configured (MiniMax_understand_image tool available)

If MCP tool is not configured

Step 1: The agent should fetch setup instructions from: https://platform.minimaxi.com/docs/token-plan/mcp-guide

Step 2: Detect the user's environment (OpenCode, Cursor, Claude Code, etc.) and output the exact commands needed. Common examples:

OpenCode — add to ~/.config/opencode/opencode.json or package.json:

{
  "mcp": {
    "MiniMax": {
      "type": "local",
      "command": ["uvx", "minimax-coding-plan-mcp", "-y"],
      "environment": {
        "MINIMAX_API_KEY": "YOUR_TOKEN_PLAN_KEY",
        "MINIMAX_API_HOST": "https://api.minimaxi.com"
      },
      "enabled": true
    }
  }
}

Claude Code:

claude mcp add -s user MiniMax --env MINIMAX_API_KEY=your-key --env MINIMAX_API_HOST=https://api.minimaxi.com -- uvx minimax-coding-plan-mcp -y

Cursor — add to MCP settings:

{
  "mcpServers": {
    "MiniMax": {
      "command": "uvx",
      "args": ["minimax-coding-plan-mcp"],
      "env": {
        "MINIMAX_API_KEY": "your-key",
        "MINIMAX_API_HOST": "https://api.minimaxi.com"
      }
    }
  }
}

Step 3: After configuration, tell the user to restart their app and verify with /mcp.

Important: If the user does not have a MiniMax Token Plan subscription, inform them that the understand_image tool requires one — it cannot be used with free or other tier API keys.

Analysis Modes

ModeWhen to usePrompt strategy
describeGeneral image understandingAsk for detailed description
ocrText extraction from screenshots, documentsAsk to extract all text verbatim
ui-reviewUI mockups, wireframes, design filesAsk for design critique with suggestions
chart-dataCharts, graphs, data visualizationsAsk to extract data points and trends
object-detectIdentify objects, people, activitiesAsk to list and locate all elements

Workflow

Step 1: Auto-detect image

The skill triggers automatically when a message contains an image file path or URL with extensions: .jpg, .jpeg, .png, .gif, .webp, .bmp, .svg

Extract the image path from the message.

Step 2: Select analysis mode and call MCP tool

Use the MiniMax_understand_image tool with a mode-specific prompt:

describe:

Provide a detailed description of this image. Include: main subject, setting/background,
colors/style, any text visible, notable objects, and overall composition.

ocr:

Extract all text visible in this image verbatim. Preserve structure and formatting
(headers, lists, columns). If no text is found, say so.

ui-review:

You are a UI/UX design reviewer. Analyze this interface mockup or design. Provide:
(1) Strengths — what works well, (2) Issues — usability or design problems,
(3) Specific, actionable suggestions for improvement. Be constructive and detailed.

chart-data:

Extract all data from this chart or graph. List: chart title, axis labels, all
data points/series with values if readable, and a brief summary of the trend.

object-detect:

List all distinct objects, people, and activities you can identify. For each,
describe what it is and its approximate location in the image.

Step 3: Present results

Return the analysis clearly. For describe, use readable prose. For ocr, preserve structure. For ui-review, use a structured critique format.

Output Format Example

For describe mode:

## Image Description

[Detailed description of the image contents...]

For ocr mode:

## Extracted Text

[Preserved text structure from the image]

For ui-review mode:

## UI Design Review

### Strengths
- ...

### Issues
- ...

### Suggestions
- ...

Notes

  • Images up to 20MB supported (JPEG, PNG, GIF, WebP)
  • Local file paths work if MiniMax MCP is configured with file access
  • The MiniMax_understand_image tool is provided by the minimax-coding-plan-mcp package

Files

1 total
Select a file
Select a file to preview.

Comments

Loading comments…