Minimax Image Gyh
Security checks across malware telemetry and agentic risk
Overview
The skill mostly does what it claims, but some included scripts silently fall back to a hardcoded MiniMax API key instead of requiring your own key.
Review this skill before installing. If you use it, set your own MINIMAX_API_KEY, avoid sending sensitive prompts, verify output paths, and do not rely on the embedded fallback key; the publisher should remove and rotate that key and declare the credential requirement properly.
VirusTotal
67/67 vendors flagged this skill as clean.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If you run this without your own MiniMax key, your prompts may be sent under an embedded account/key with unclear ownership, billing, audit, and privacy implications.
The script embeds a MiniMax API key and silently uses it when MINIMAX_API_KEY is not set, despite the skill description framing the environment variable as the credential mechanism.
DEFAULT_API_KEY = "sk-cp-MFXJC1..."; api_key = os.environ.get("MINIMAX_API_KEY") or DEFAULT_API_KEYRemove and revoke the embedded key, require MINIMAX_API_KEY explicitly, and declare that credential in the skill metadata before use.
Prompts are shared with MiniMax, and generated images can overwrite or add files wherever the output path points.
The script sends the user prompt to the MiniMax API and writes the returned image to a caller-specified path; this is expected for the skill but is still network and file-mutation behavior.
resp = requests.post(url, headers=HEADERS, json=payload, timeout=60) ... with open(path, "wb") as f: f.write(resp.content)
Avoid sensitive prompts, confirm the output path before running, and use the skill only when image generation is intended.
Users may need to install an external Python package that is not pinned or installed through a reviewed install spec.
The skill asks for a manual, unpinned Python package install while the provided install specification is absent; this is a disclosed setup step but not fully managed by metadata.
- `pip3 install requests`
Install dependencies only from trusted package sources, and prefer a publisher-provided pinned requirements file or install spec.