Security audit

minimax-understand-image

Security checks for vulnerabilities and agentic risk

Overview

This image-analysis skill is mostly purpose-aligned, but it asks users to run unverified remote installers and launches an unpinned third-party MCP package with broad access to credentials and the user's environment.

Install only after reviewing the setup commands and trusting the MiniMax MCP package source. Prefer installing uv through a trusted package manager, pinning the MCP package version, avoiding mirror-based installs unless approved, and limiting what environment variables are passed to the subprocess. Treat submitted images and prompts as data sent to a third-party service, and avoid using this skill on sensitive screenshots, documents, or photos unless that is acceptable.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:19
Finding: Unverified Remote Installation Script Is Piped Directly into a Shell
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:19-39; related unsafe recommendation at scripts/understand_image.py:101-104
Vulnerability Type: Unverified remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash
# SKILL.md:24 curl -LsSf https://astral.sh/uv/install.sh | sh

bash
# SKILL.md:31-32 export UV_INDEX_URL="https://pypi.tuna.tsinghua.edu.cn/simple" curl -LsSf https://astral.sh/uv/install.sh | sh

bash
# SKILL.md:37-38 export UV_INDEX_URL="https://mirrors.aliyun.com/pypi/simple/" curl -LsSf https://astral.sh/uv/install.sh | sh

The Python script also recommends the same command when uvx is unavailable:

python
except FileNotFoundError: print("Error: uvx not found. Please install it first: curl -LsSf https://astral.sh/uv/install.sh | sh", file=sys.stderr) sys.exit(1)

Technical Analysis

The installation instructions download mutable content from an external URL and pass it directly to sh. There is no intermediate inspection, version pinning, signature validation, or checksum verification.

HTTPS protects transport integrity under normal conditions, but it does not ensure that the content currently hosted at the URL is identical to the content reviewed during this audit. If the hosting account, domain, CDN, TLS trust chain, or installation script is compromised, arbitrary replacement commands will execute immediately.

Installing uv is relevant to the declared image-analysis workflow because the Skill uses uvx. However, executing an unverified, remotely mutable script is not the minimum-risk method of satisfying that dependency. The Python file does not execute the command automatically, but it reinforces the vulnerable workflow by presenting the command directly to users.

Attack Path

An attacker compromises the installation endpoint, its delivery infrastructure, or another trusted component in the ...[truncated 1112 chars]
Remediation: View remediation
Remediation Suggestions

Remove all curl ... | sh instructions, including the recommendation in the Python error handler.

Prefer a trusted operating-system package manager or another installation mechanism that supports signed, versioned packages.

If an installation script is unavoidable:

Download it to a local file without executing it.

Use a version-specific URL.

Verify a publisher-provided cryptographic signature or pinned SHA-256 digest.

Present the file for inspection before execution.

Execute it as an unprivileged user.

Document the expected installer version and trusted signing identity.

Replace the Python error message with a link to verified installation documentation rather than an immediately executable shell pipeline.

Avoid recommending elevated execution such as sudo unless a specific operation demonstrably requires it.

T08 · Insecure Dependencies

Error

Location: scripts/understand_image.py:57
Finding: Unpinned Third-Party MCP Package Executes with API Credentials and the Full Parent Environment
Content: View full analysis
Vulnerability Details

File Location: scripts/understand_image.py:57-65; package installation instructions at SKILL.md:42-67
Vulnerability Type: Mutable dependency execution and excessive environment-variable exposure
Risk Level: High

Vulnerable Code

python
proc = subprocess.Popen( ['uvx', 'minimax-coding-plan-mcp'], stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, env={**os.environ, **env}, text=True )

The related instructions install or invoke the package without an exact version or artifact hash:

bash
uvx minimax-coding-plan-mcp --help

bash
uvx install minimax-coding-plan-mcp

Alternative index configuration remains unpinned:

bash
export UV_INDEX_URL="https://pypi.tuna.tsinghua.edu.cn/simple" uvx install minimax-coding-plan-mcp

bash
export UV_INDEX_URL="https://mirrors.aliyun.com/pypi/simple/" uvx install minimax-coding-plan-mcp

Technical Analysis

The Skill invokes minimax-coding-plan-mcp without specifying an audited version or validating package artifacts. Depending on uvx state and package availability, this can retrieve and execute a release that differs from the one originally reviewed. This creates a supply-chain trust boundary around the package registry, configured mirrors, publisher account, package metadata, and all transitive dependencies.

The child process receives an environment assembled as follows:

python
env={**os.environ, **env}

Consequently, the third-party dependency receives every variable inherited by the Python process, plus MINIMAX_API_KEY, MINIMAX_MCP_BASE_PATH, and MINIMAX_API_HOST. Only a limited subset is necessary to run the MCP server. Unrelated cloud credentials, CI tokens, proxy credentials, or service secrets present in the parent environment are unnecessarily exposed to the dependency.

Use of a list-form `subprocess.P ...[truncated 1692 chars]
Remediation: View remediation
Remediation Suggestions

Pin minimax-coding-plan-mcp to a specifically audited version.

Use a lockfile and require cryptographic hashes for the package and its transitive dependencies where supported.

Avoid resolving and executing the latest package release during ordinary Skill invocation.

Verify the package publisher and document the trusted registry. Treat alternative mirrors as separate trust boundaries and avoid them unless their integrity controls are established.

Build a minimal subprocess environment instead of inheriting all of os.environ. Include only required variables, such as:

A controlled PATH.

MINIMAX_API_KEY.

MINIMAX_MCP_BASE_PATH.

MINIMAX_API_HOST.

Any strictly necessary locale or runtime variables.

Run the MCP server with an isolated home directory and restricted filesystem permissions where practical.

Apply outbound network restrictions so the process can contact only required MiniMax endpoints.

Store the API key with restrictive file permissions and rotate it if dependency compromise is suspected.

Add dependency review and automated integrity verification to the release process.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (25)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: The pipe into sh creates a command chain where untrusted network content is executed immediately by the shell. This is a classic arbitrary-code-execution pattern and is especially risky in agent workflows that may follow instructions automatically.
Content: Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.
方法 1: 使用官方安装脚本（推荐）

bash
curl -LsSf https://astral.sh/uv/install.sh | sh

方法 2: 使用国内镜像加速（如果官方脚本下载失败）

Chaining Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: This chained command combines network retrieval and shell execution into one step, bypassing meaningful inspection and increasing the blast radius of a compromise. Mirror selection does not change the fundamental danger of executing untrusted remote script content.
Content: Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.
临时使用清华镜像源安装：

bash
export UV_INDEX_URL="https://pypi.tuna.tsinghua.edu.cn/simple" curl -LsSf https://astral.sh/uv/install.sh | sh

或者临时使用阿里云镜像源：

Chaining Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: The construct executes whatever bytes are returned over the network as shell commands, which can fully compromise the host if tampered with. Because the skill is for image analysis, this behavior is disproportionate to the declared purpose and therefore more suspicious in context.
Content: Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.
或者临时使用阿里云镜像源：

bash
export UV_INDEX_URL="https://mirrors.aliyun.com/pypi/simple/" curl -LsSf https://astral.sh/uv/install.sh | sh

1.2 检查 MCP 服务器是否已安装

Env Variable Harvesting

High

Category: Data Exfiltration
Confidence: 97% confidence
Finding: The child process inherits the entire parent environment via {**os.environ, **env}, which can unintentionally expose unrelated secrets such as cloud tokens, CI credentials, proxy settings, and internal configuration to the external MCP executable. This is especially dangerous in a skill that launches third-party tooling, because any compromised or unexpected child process gains broad access to ambient secrets far beyond the intended MiniMax API key.
Content: Scanner excerpt · scripts/understand_image.py (reported line 69)May include surrounding context.
python
stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, env={**os.environ, **env}, text=True )

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill invokes shell commands, reads local configuration files, uses environment variables, and accesses network resources, yet it declares no explicit tool scope or permission boundaries. This increases the chance that an agent will execute higher-risk capabilities implicitly without user awareness or policy enforcement.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest description says the skill triggers when a user asks to analyze, understand, or describe an image, and when object/text/scene recognition is needed. These conditions are very broad and do not clearly distinguish when this specific skill should activate versus a generic vision or description capability, increasing the chance of unintended invocation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 87% confidence
Finding: The MCP server is referenced via uvx without a pinned version, so future executions may pull a changed or compromised package unexpectedly. This creates supply-chain risk and makes the skill non-reproducible across runs and environments.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: Using uvx install without version pinning allows the environment to fetch the latest available package state at install time. An attacker controlling or compromising the package source could introduce malicious behavior into the installed MCP server.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The mirror-based install path still omits version pinning, so the package retrieved from the mirror may vary over time and may not match the reviewed version. This broadens supply-chain exposure because both the package and the mirror trust chain matter.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: This alternate mirror installation also retrieves an unpinned package, exposing the workflow to package substitution, malicious updates, or accidental breaking changes. In an agent skill, such behavior is risky because the agent may automate the install without careful review.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs the agent to search another local auth profile file for MiniMax-related keys, which is unrelated to understanding an image and expands access into unrelated secrets. This is dangerous because it normalizes credential harvesting from local files and can expose sensitive tokens without a clear need-to-know basis.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 94% confidence
Finding: The skill writes the API key into a persistent config file under the user's home directory, creating long-lived credential storage on disk. Persistent secrets increase exposure to later compromise through local file access, backups, logs, or multi-step agent abuse.
Content: Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.
3.3 保存 API Key

bash
mkdir -p ~/.openclaw/config cat > ~/.openclaw/config/minimax.json << EOF { "api_key": "API密钥",

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill directs agents to send image files or URLs to an external MiniMax service without an explicit warning that user data will leave the local environment. Images often contain sensitive visual content, embedded text, metadata, or internal URLs, so silent transmission can cause privacy and confidentiality breaches.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script automatically loads an API key from the environment or a local config file and passes it to an external MCP subprocess without any explicit user notice or consent. In a skill context, this is sensitive because users may not realize their credential is being delegated to another executable, increasing the chance of unintended credential exposure if that tool is compromised or replaced.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The image source and free-form prompt are transmitted to an external MCP tool/API, but the script gives no user-facing disclosure that local image paths, image contents, or prompt text may leave the local environment. In an image-analysis skill, this context increases sensitivity because users may submit screenshots, personal photos, or documents containing confidential data.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/understand_image.py (reported line 64)May include surrounding context.
python
] try: proc = subprocess.Popen( ['uvx', 'minimax-coding-plan-mcp'], stdin=subprocess.PIPE, stdout=subprocess.PIPE,

Tainted flow: 'env' from os.environ.get (line 28, credential/environment) → subprocess.Popen (code execution)

Medium

Category: Data Flow
Confidence: 65% confidence
Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
Content: Scanner excerpt · scripts/understand_image.py (reported line 64)May include surrounding context.
python
] try: proc = subprocess.Popen( ['uvx', 'minimax-coding-plan-mcp'], stdin=subprocess.PIPE, stdout=subprocess.PIPE,

Rp1

Medium

Category: MCP Rug Pull
Confidence: 65% confidence
Finding: uvx/uv tool run commands without ==version create a rug-pull risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: All user-facing natural-language instructions in the skill file are presented in Chinese, and the file does not indicate that the user can choose another language. This may constitute a language-policy issue if skills are expected not to force a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The workflow extends beyond image analysis into software installation and persistent secret configuration, increasing the skill's operational and security footprint. This creates more opportunities for unsafe execution, persistence, and accidental modification of the host environment.
Content: No source excerpt is available for this finding.

External Script Fetching

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: The skill fetches a remote installation script and immediately executes it, which removes any opportunity for integrity review before code execution. If the remote host, connection, or script content is compromised, arbitrary code runs on the user's machine.
Content: Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.
方法 1: 使用官方安装脚本（推荐）

bash
curl -LsSf https://astral.sh/uv/install.sh | sh

方法 2: 使用国内镜像加速（如果官方脚本下载失败）

External Script Fetching

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: This variant still executes a remotely fetched script directly, with the additional complexity of alternate package-index configuration. The presence of mirrors does not mitigate the risk of arbitrary code execution from the install script itself.
Content: Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.
临时使用清华镜像源安装：

bash
export UV_INDEX_URL="https://pypi.tuna.tsinghua.edu.cn/simple" curl -LsSf https://astral.sh/uv/install.sh | sh

或者临时使用阿里云镜像源：

External Script Fetching

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: Direct execution of a downloaded script remains a high-risk bootstrap mechanism because it trusts remote content at execution time. In an automated skill context, this is more dangerous because it may be run non-interactively and without human inspection.
Content: Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.
或者临时使用阿里云镜像源：

bash
export UV_INDEX_URL="https://mirrors.aliyun.com/pypi/simple/" curl -LsSf https://astral.sh/uv/install.sh | sh

1.2 检查 MCP 服务器是否已安装

External Script Fetching

Low

Category: Supply Chain
Confidence: 93% confidence
Finding: The error message recommends installing uv via a curl-pipe-to-shell command, which is a risky supply-chain pattern because it encourages direct execution of remote script content without independent verification. Even though the script does not execute the command itself, embedding this guidance in a skill normalizes unsafe installation behavior for operators.
Content: Scanner excerpt · scripts/understand_image.py (reported line 103)May include surrounding context.
python
print("Error: Request timed out", file=sys.stderr) sys.exit(1) except FileNotFoundError: print("Error: uvx not found. Please install it first: curl -LsSf https://astral.sh/uv/install.sh | sh", file=sys.stderr) sys.exit(1) except Exception as e: print(f"Error: {e}", file=sys.stderr)

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The example command uses a Chinese prompt literal ('描述这张图片') as the sole illustrated usage. While not a hard runtime restriction, this natural-language example may imply a preferred language without documenting that other languages are supported or user-selectable.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

SkillSpector

Chaining Abuse

Chaining Abuse

Chaining Abuse

1.2 检查 MCP 服务器是否已安装

Env Variable Harvesting

Undeclared Tool Scope

Vague Triggers

Rp1

Rp1

Rp1

Rp1

Context-Inappropriate Capability

Session Persistence

3.3 保存 API Key

Missing User Warnings

Missing User Warnings

Missing User Warnings

subprocess module call

Tainted flow: 'env' from os.environ.get (line 28, credential/environment) → subprocess.Popen (code execution)

Rp1

Natural-Language Policy Violations

Description-Behavior Mismatch

External Script Fetching

External Script Fetching

External Script Fetching

1.2 检查 MCP 服务器是否已安装

External Script Fetching

Natural-Language Policy Violations

Static analysis