ClawHub
Back to skill

Security audit

MiniMax image-01 · AI Text-to-Image Tool

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward MiniMax image-generation helper, with expected API-key use and outbound prompt submission but no hidden persistence or unrelated data access found.

Install only if you are comfortable sending image prompts to MiniMax and using your MiniMax quota. Store MINIMAX_API_KEY as an environment variable, avoid sensitive personal or secret data in prompts, install dependencies in a virtual environment, and write outputs to a private directory where overwriting minimax_gen_*.png will not damage existing files.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Note
Location
SKILL.md:21
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/image_gen.py:110
Finding

Predictable Output Files Permit Symlink-Based File Overwrite

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (17)

Tainted flow: 'headers' from os.environ.get (line 75, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/image_gen.py (reported line 93)May include surrounding context.

python
if enhance:
        print(f"[minimax-image-gen] Prompt enhanced: {final_prompt[:60]}...", file=sys.stderr)

    response = requests.post(url, headers=headers, json=payload, timeout=60)
    response.raise_for_status()

    data = response.json()

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

The skill description promises behavior that is broader or different from what is actually documented, including broad natural-language trigger support, quota-related claims, and undeclared local file output behavior. Description/behavior mismatch is dangerous because it can mislead users and automated routing into invoking the skill under assumptions that are not enforced, reducing informed consent and review accuracy.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/prompt_templates.md (reported line 5)May include surrounding context.

md
## Region & API Configuration

| Region | API Endpoint | Get Key From |
|--------|-------------|-------------|
| **China** | `api.minimax.chat` | platform.minimaxi.com |
| **Global** | `api.minimax.io` | www.minimax.io |

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/image_gen.py (reported line 39)May include surrounding context.

python
"""Enhance short prompts with professional parameters."""
    if len(prompt.split()) < 8:
        return DEFAULT_ENHANCEMENT_PREFIX + prompt
    return prompt


def get_api_key_and_url(region: str):

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The listing states that the skill uses an API key and sends prompts to MiniMax endpoints, but it does not clearly warn users that their text input will be transmitted to an external service or explain what data may leave the local environment. This can lead to users unintentionally sharing sensitive information in prompts, while also exposing them to unexpected network activity and account quota usage.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The example trigger phrases are very broad natural-language requests like “帮我画” and “画一只猫,” which can easily overlap with ordinary conversation and cause the skill to run when the user may only be speaking generally. In an agent environment, this increases the risk of unintended external API calls, token consumption, and prompt transmission to a third-party service without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documented trigger phrases are very broad natural-language expressions like “帮我画” and “画一只猫,” which overlap heavily with ordinary conversation and can cause accidental invocation of the skill. In an agent ecosystem, this increases the chance of unintended tool execution and unreviewed outbound API usage, especially because the examples imply automatic execution of a Python command.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The documentation instructs users to configure a MiniMax API key but does not warn that the credential is sensitive, should not be hardcoded, logged, committed, or shared with prompts and generated outputs. This omission can lead to credential leakage through misconfiguration, screenshots, shell history, or repository commits, resulting in unauthorized API use and quota or billing abuse.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README documents very broad natural-language triggers such as '帮我画' and 'generate an image' without defining clear activation boundaries, exclusions, or confirmation logic. In an agent environment, overly generic trigger phrases can cause unintended invocation during ordinary conversation, which may lead to unexpected external API use, quota consumption, and accidental transmission of user prompts to a third-party service.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill documents use of environment secrets and outbound network access, but it does not declare an explicit tool scope such as permissions or allowed-tools. That weakens least-privilege controls and makes the skill's effective capabilities less transparent to users and reviewers, increasing the chance of unintended secret access or data transmission.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The listed trigger phrases are very broad and overlap with common user requests such as 'draw' or 'generate an image.' Overbroad activation language can cause the skill to be selected too often, leading to unintended transmission of prompts to third-party services and surprise use of API-backed functionality.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md
# API endpoints by region
ENDPOINTS = {
    "global": "https://api.minimax.io/v1/image_generation",
    "cn": "https://api.minimax.chat/v1/image_generation",
}

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/image_gen.py (reported line 24)May include surrounding context.

python
# API endpoints by region
ENDPOINTS = {
    "global": "https://api.minimax.io/v1/image_generation",
    "cn": "https://api.minimax.chat/v1/image_generation",
}

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md
# API endpoints by region
ENDPOINTS = {
    "global": "https://api.minimax.io/v1/image_generation",
    "cn": "https://api.minimax.chat/v1/image_generation",
}

DEFAULT_ENHANCEMENT_PREFIX = (

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/image_gen.py (reported line 25)May include surrounding context.

python
# API endpoints by region
ENDPOINTS = {
    "global": "https://api.minimax.io/v1/image_generation",
    "cn": "https://api.minimax.chat/v1/image_generation",
}

DEFAULT_ENHANCEMENT_PREFIX = (

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/image_gen.py (reported line 93)May include surrounding context.

python
if enhance:
        print(f"[minimax-image-gen] Prompt enhanced: {final_prompt[:60]}...", file=sys.stderr)

    response = requests.post(url, headers=headers, json=payload, timeout=60)
    response.raise_for_status()

    data = response.json()

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/image_gen.py (reported line 139)May include surrounding context.

python
parser.add_argument("--n", type=int, default=1,
                        help="Number of images (1-9)")
    parser.add_argument("--no-enhance", action="store_true",
                        help="Disable prompt enhancement")
    parser.add_argument("--region", "-r", required=True,
                        choices=["cn", "global"],
                        help="API region: cn (China) or global (International)")

Static analysis

No suspicious patterns detected.