!
Purpose & Capability
The declared purpose (generate Unreal Engine material node graphs) matches the SKILL.md content describing project files and node types. However, the skill embeds an external model API (api.minimaxi.com) and a hardcoded API key directly in SKILL.md while the registry metadata lists no required credentials — that is disproportionate and inconsistent.
!
Instruction Scope
Runtime instructions direct the agent to use a remote API and provide an example App URL and sample JSON. That means user-provided material descriptions and possibly project content would be sent to an external service (minimaxi) not declared in metadata; SKILL.md does not limit or explain what data is transmitted.
✓
Install Mechanism
This is an instruction-only skill with no install spec or code files to be written to disk, which minimizes installation risk.
!
Credentials
No required environment variables are declared, yet a sensitive-looking API key is embedded in SKILL.md. The hardcoded key is a secret (pattern 'sk-...') and its presence without being declared or explained is disproportionate and risky (exposes credentials and hides external trust boundaries).
✓
Persistence & Privilege
The skill does not request persistent/always-on privileges and is user-invocable only. There is no indication it modifies other skills or system-wide settings.
What to consider before installing
Do not install this skill without addressing the external API and the hardcoded key. Specific steps to consider:
- The SKILL.md embeds an API base (api.minimaxi.com), an App URL, and a hardcoded API key; this means your prompts and possibly project data would be sent to that third party. Only proceed if you trust that endpoint and its privacy/security practices.
- Ask the publisher to remove the hardcoded key and require a declared environment variable (e.g., MINIMAXI_API_KEY) so you can supply your own credential; never use the embedded key.
- Verify who operates minimaxi.com and the App domain (k2lucelsen19.space.minimaxi.com). If you cannot verify ownership, avoid sending proprietary assets or code to it.
- Prefer skills that declare required credentials in metadata and document what data is transmitted. If you already pasted sensitive material while testing, rotate any credentials that may have been exposed.
- If you need this functionality but want safer operation, request an updated skill that uses a user-supplied API key (declared in requires.env) and documents exactly what is posted to the remote API.
