✓
Purpose & Capability
The skill declares and uses the uvx binary and MINIMAX_API_KEY/HOST environment variables and its scripts call uvx to run an MCP ('minimax-coding-plan-mcp') for image understanding and web search. These requirements are appropriate for the described MiniMax MCP integration.
ℹ
Instruction Scope
Runtime instructions are narrowly scoped to running the bundled Python scripts which invoke uvx via subprocess. However there are small inconsistencies in the documentation: some places say to install 'uv' (brew install uv) while the scripts check for and invoke 'uvx'; SKILL.md lists MINIMAX_API_HOST as required but the scripts supply a sensible default. The docs also mention Telegram images auto-saved to ~/.openclaw/media/inbound/ (informational) but the scripts do not automatically scan that directory — they accept a provided image path.
ℹ
Install Mechanism
There is no automated install spec (instruction-only), which keeps risk low. The references/docs recommend installing uv/uvx and include a curl|sh installer URL (https://astral.sh/uv/install.sh) as a fallback — that external install command is not executed by the skill but is recommended to users and carries the usual risks of piping a remote script to sh. No archives or arbitrary downloads are embedded in the skill.
✓
Credentials
The skill requests only MINIMAX_API_KEY and MINIMAX_API_HOST, which are proportionate to a MiniMax API integration. The scripts explicitly limit the environment passed to the subprocess to avoid leaking unrelated variables and set a local MINIMAX_MCP_BASE_PATH. Note: MINIMAX_API_HOST is treated as optional in code (defaults to https://api.minimaxi.com) despite being listed as required in metadata.
✓
Persistence & Privilege
The skill does not request permanent/always-on presence (always:false) and does not modify other skills or global agent configuration. It runs as-invoked and requires no elevated privileges.
Scan Findings in Context
[subprocess-popen] expected: The scripts use subprocess.Popen to run 'uvx minimax-coding-plan-mcp' and communicate via JSON-RPC over stdin/stdout. This is expected for an MCP client that shells out to a local binary.
[subprocess-run] expected: test.py uses subprocess.run to check for uvx and to py_compile scripts. This is normal for a test/verification script.
[remote-install-script-url] expected: references/setup.md suggests a fallback curl|sh installer (https://astral.sh/uv/install.sh). It's part of user instructions (not executed by the skill), but running such installers should be done cautiously.
[local-path-reference] expected: Documentation references the Telegram inbound media directory (~/.openclaw/media/inbound/) as an image source. This is informational; the scripts require an explicit image path argument.
Assessment
This skill appears to do what it says: it runs local Python scripts that call the uvx MCP client using your MiniMax API key. Before installing or running: (1) confirm which binary you should install — the scripts call 'uvx' but some docs say 'uv'; install the correct package from a trusted source (prefer your package manager). (2) Do not paste your API key into third‑party install scripts; if you run any curl|sh installer linked in the docs, review the script first. (3) Only set MINIMAX_API_KEY for services you trust and avoid exporting other secrets globally. (4) If you need added assurance, inspect the included Python files (they are small and readable) and verify the GitHub/homepage link before publishing or giving the skill access to your environment.
