ClawHub
Back to skill

Security audit

Minimax Mcp

Security checks for vulnerabilities and agentic risk

Overview

The skill’s MiniMax search and image-analysis purpose is coherent, but installation and runtime guidance expose users to mutable third-party code and sensitive API-key handling risks.

Review this before installing. Prefer a pinned, reviewed MCP package version, avoid the `curl | sh` installer path, use a dedicated minimally scoped MiniMax API key, keep credentials out of shell history and shared config files, and do not submit confidential images, screenshots, internal URLs, or regulated data unless MiniMax processing is approved for that data.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:117
Finding

Remote Installer Downloaded and Executed Without Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:117; duplicated in references/examples.md:98-103
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable code in SKILL.md:117:

bash
curl -LsSf https://astral.sh/uv/install.sh | sh

Duplicated installation instructions in references/examples.md:98-103:

bash
# If not found, install uv first
brew install uv
# or
curl -LsSf https://astral.sh/uv/install.sh | sh

Technical Analysis

The instructions pipe a mutable remote response directly into the local shell. The downloaded script is not pinned to a specific release and is not saved for inspection or verified using a cryptographic hash or signature before execution.

HTTPS protects the connection in transit but does not establish that the payload remains identical to the version intended when the Skill was reviewed. Compromise of the upstream website, its hosting infrastructure, DNS resolution, certificate issuance, or release process could replace the installer with attacker-controlled shell commands.

Installing the required uv executable is legitimate for the declared MCP functionality, but immediate remote shell execution exceeds the minimum necessary installation behavior. A trusted package manager is already offered as an alternative and avoids this particular execution pattern.

Attack Path

  1. A user attempts to configure the Skill and encounters the documented uvx not found or spawn uvx ENOENT error.
  2. The user copies the recommended curl ... | sh command.
  3. The shell retrieves whatever content the remote URL serves at that moment.
  4. The response is passed directly to sh without user inspection, version pinning, checksum verification, or signature validation.
  5. If the response is malicious or compromised, its commands execute with the privileges of the user running the installation.
  6. The payload can access th ...[truncated 690 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the curl | sh installation path from both documentation files.

  2. Prefer a trusted operating-system package manager, such as:

    bash
    brew install uv

  3. If a standalone installer is required:

    • Pin it to a specific audited release.
    • Download it to a local file rather than piping it into a shell.
    • Verify a publisher-provided cryptographic checksum and, where available, a signed release artifact.
    • Display or inspect the script before execution.
    • Run it without administrative privileges unless elevation is demonstrably required.

  4. Document the expected files and configuration changes produced by installation.

  5. Provide uninstall and integrity-verification procedures.

T08 · Insecure Dependencies

Error
Location
SKILL.md:68
Finding

Unpinned Third-Party MCP Package Is Retrieved and Executed at Runtime

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:68-72; repeated in references/examples.md:119-127
Vulnerability Type: Insecure dependency execution
Risk Level: High

Vulnerable code in SKILL.md:68-72:

bash
# Add MCP server
mcporter config add minimax \
  --command "uvx minimax-coding-plan-mcp -y" \
  --env MINIMAX_API_KEY="your-key" \
  --env MINIMAX_API_HOST="https://api.minimaxi.com"

Equivalent configuration in references/examples.md:119-127:

json
{
  "mcpServers": {
    "MiniMax": {
      "command": "uvx",
      "args": ["minimax-coding-plan-mcp", "-y"],
      "env": {
        "MINIMAX_API_KEY": "your-api-key",
        "MINIMAX_API_HOST": "https://api.minimaxi.com"
      }
    }
  }
}

Technical Analysis

The MCP server is invoked by package name without an exact version, artifact hash, lockfile, or vendored audited source. uvx can resolve, retrieve, and execute the package from a third-party package repository. Consequently, the effective executable code may change after this Skill has been reviewed.

This project contains only instructions and metadata; it does not include the MCP server's implementation. The audit therefore cannot verify what filesystem, process, credential, or network operations the resolved package performs.

Runtime package execution is required to provide the declared MCP service, but executing an unpinned package grants a mutable supply-chain dependency more authority than necessary. Pinning and integrity verification would preserve the functionality while reducing this exposure.

Attack Path

  1. The user registers the MCP server using the provided command or JSON configuration.
  2. The Agent or MCP client invokes uvx.
  3. uvx resolves minimax-coding-plan-mcp without an exact audited version constraint.
  4. A malicious release could be supplied following compromise of the package, maintainer account, build p ...[truncated 778 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin minimax-coding-plan-mcp to an exact, reviewed version.
  2. Use a lockfile or equivalent mechanism containing cryptographic artifact hashes.
  3. Document the expected package index and prevent fallback to untrusted indexes.
  4. Review the pinned MCP server source and its transitive dependencies.
  5. Upgrade only through an explicit review process rather than resolving an unrestricted current release at runtime.
  6. Run the MCP process with restricted filesystem access, a minimal environment, and only the network access required for the selected MiniMax endpoint.
  7. Pass only the MiniMax credential required for operation; do not expose unrelated secrets to the MCP process.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:68
Finding

API Credential Is Documented in Shell Arguments and Plaintext Configuration

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:68-72; persistent configuration example at references/examples.md:119-127
Vulnerability Type: Plaintext sensitive-data handling
Risk Level: Medium

Vulnerable command in SKILL.md:68-72:

bash
# Add MCP server
mcporter config add minimax \
  --command "uvx minimax-coding-plan-mcp -y" \
  --env MINIMAX_API_KEY="your-key" \
  --env MINIMAX_API_HOST="https://api.minimaxi.com"

Plaintext configuration in references/examples.md:119-127:

json
{
  "mcpServers": {
    "MiniMax": {
      "command": "uvx",
      "args": ["minimax-coding-plan-mcp", "-y"],
      "env": {
        "MINIMAX_API_KEY": "your-api-key",
        "MINIMAX_API_HOST": "https://api.minimaxi.com"
      }
    }
  }
}

Technical Analysis

The displayed values are placeholders and are not actual leaked credentials. However, the documented workflow directs users to replace them with a real API key in a shell command or persistent JSON configuration.

A key entered directly on a command line can remain in shell history and may be exposed through command logging or process inspection, depending on how the command is handled. A key embedded in MCP configuration remains in plaintext and can be disclosed through permissive file permissions, backups, synchronization services, diagnostic bundles, or accidental sharing.

Supplying a MiniMax credential to the MCP server is necessary for the declared functionality. Persisting it directly in shell history or unprotected configuration is not necessary and violates least-exposure principles.

Attack Path

  1. A user replaces your-key or your-api-key with a valid MiniMax API credential.
  2. The user executes the command, causing the credential-bearing command to be retained in shell history, or saves it in the MCP JSON configuration.
  3. Another local user, process, backup reader, support-bundle recipient, ...[truncated 785 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not place real credentials directly in command-line arguments.
  2. Obtain the key through a non-echoing interactive prompt, operating-system keychain, or dedicated secret manager.
  3. Configure the MCP client to reference a protected secret at runtime rather than embedding its value in JSON.
  4. If a local environment or configuration file is unavoidable:
    • Keep it outside version control.
    • Restrict permissions to the owning user.
    • Prevent inclusion in backups, logs, and diagnostic bundles where feasible.
    • Avoid storing unrelated credentials in the same process environment.
  5. Add explicit instructions for key rotation and immediate revocation after suspected exposure.
  6. Use a dedicated, minimally scoped API key and monitor usage and billing for anomalies.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

Piping curl output directly into 'sh' creates an execution chain from untrusted network content to a shell without validation, which is a classic command-execution hazard. In documentation, this pattern is especially risky because it normalizes unsafe operator behavior and can lead to immediate compromise if the upstream content is tampered with.

Content

Scanner excerpt · references/examples.md (reported line 103)May include surrounding context.

If not found, install uv first

brew install uv

or

curl -LsSf https://astral.sh/uv/install.sh | sh

text

---

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill advertises image analysis, URL extraction, and web search but does not warn that image URLs, page URLs, and potentially retrieved page content may be sent to MiniMax-operated services for processing. This is a privacy and data-handling issue because users may provide sensitive internal URLs, private images, or confidential content without realizing it leaves the local environment. The MCP context increases risk because the skill is explicitly triggered on user content and external resources.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

The skill instructs users to run uvx minimax-coding-plan-mcp -y without pinning an exact package version. This creates a supply-chain risk because future package updates could introduce malicious or vulnerable code and would be fetched automatically at runtime. In an MCP skill context, this is more dangerous because the package is intended to run as a server component with access to API keys and user-provided content.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
65% confidence
Finding

uvx/uv tool run commands without ==version create a rug-pull risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The image-analysis examples encourage use of both remote URLs and local file paths without warning that image contents may be transmitted to an external API service. Users may unintentionally upload sensitive local images, screenshots, or documents, creating confidentiality and privacy risks in a tool specifically designed to process image content.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
65% confidence
Finding

uvx/uv tool run commands without ==version create a rug-pull risk.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
65% confidence
Finding

uvx/uv tool run commands without ==version create a rug-pull risk.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
65% confidence
Finding

uvx/uv tool run commands without ==version create a rug-pull risk.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
92% confidence
Finding

The troubleshooting section recommends curl -LsSf https://astral.sh/uv/install.sh | sh, which executes a remote script directly from the network without prior verification. This is dangerous because compromise of the hosting endpoint, transport, or script contents could lead to arbitrary code execution on the user's machine. In a setup guide for an MCP-related tool, users are especially likely to copy-paste the command verbatim.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

md
## Troubleshooting

- **"uvx not found"**: Install uv - `brew install uv` or `curl -LsSf https://astral.sh/uv/install.sh | sh`
- **"Invalid API key"**: Confirm API Key and Host are from the same region
- **Image download failed**: Ensure image URL is publicly accessible, supports JPEG/PNG/WebP

External Script Fetching

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The documentation recommends fetching and executing a remote install script directly with 'curl ... | sh', which bypasses verification and executes network-delivered code immediately. If the remote host, transport, or script distribution path is compromised, users could run attacker-controlled code on their systems.

Content

Scanner excerpt · references/examples.md (reported line 103)May include surrounding context.

If not found, install uv first

brew install uv

or

curl -LsSf https://astral.sh/uv/install.sh | sh

text

---

Static analysis

No suspicious patterns detected.