ClawHub
Back to skill

Security audit

MiniMax Video Generation

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent MiniMax video-generation helper, but its script can upload any readable local file path as an image without validation or confirmation.

Install only if you trust MiniMax with the prompts and images you provide. Do not pass sensitive local paths as --first-image or --last-image, and prefer adding file type/size validation plus an explicit upload confirmation before use in shared or sensitive workspaces.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate_video.py:49
Finding

Unrestricted Local File Encoding and Upload

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (24)

Tainted flow: 'headers' from os.getenv (line 95, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate_video.py (reported line 78)May include surrounding context.

python
}

    print(f"正在创建视频生成任务 ({model})...")
    response = requests.post(url, json=payload, headers=headers, timeout=60)
    result = response.json()

    if result.get("base_resp", {}).get("status_code") != 0:

Tainted flow: 'headers' from os.getenv (line 95, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate_video.py (reported line 97)May include surrounding context.

python
headers = {"Authorization": f"Bearer {api_key}"}

    response = requests.get(url, headers=headers, timeout=30)
    return response.json()

Tainted flow: 'api_key' from os.getenv (line 103, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate_video.py (reported line 105)May include surrounding context.

python
"""下载视频到本地"""
    api_key = api_key or os.getenv("MINIMAX_API_KEY")

    file_resp = requests.get(
        f"https://api.minimaxi.com/v1/files/retrieve?file_id={file_id}",
        headers={"Authorization": f"Bearer {api_key}"}
    )

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · scripts/generate_video.py (reported line 6)May include surrounding context.

python
MiniMax 视频生成工具
支持文生视频、图生视频、首尾帧生成视频
自动保存视频到本地，显示进度
用法: python generate_video.py "视频描述" --model MiniMax-Hailuo-2.3
     python generate_video.py "视频描述" --model MiniMax-Hailuo-2.3 --first-image path/to/image.jpg
     python generate_video.py "视频描述" --model MiniMax-Hailuo-02 --first-image start.jpg --last-image end.jpg
"""

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill demonstrates use of environment variables and outbound network access, but the manifest does not declare an explicit tool scope or permissions boundary. This creates a governance gap: an agent may invoke the skill without clear user/admin understanding that it can read secrets and send data to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The examples send user prompts and, in image-based modes, uploaded images to MiniMax's external API, but the skill does not clearly warn users about this data transfer at the point of use. This can cause unintended disclosure of sensitive personal, proprietary, or regulated content to a third party.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This finding is a duplicate form of the same external POST call to the MiniMax API. It is not malicious code, but it does create the same externally visible data flow and should be treated as a real transmission risk in the absence of explicit consent and scoping.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md
API_KEY = os.getenv("MINIMAX_API_KEY")

response = requests.post(
    "https://api.minimaxi.com/v1/video_generation",
    headers={
        "Authorization": f"Bearer {API_KEY}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This finding is a duplicate form of the same external POST call to the MiniMax API. It is not malicious code, but it does create the same externally visible data flow and should be treated as a real transmission risk in the absence of explicit consent and scoping.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md
API_KEY = os.getenv("MINIMAX_API_KEY")

response = requests.post(
    "https://api.minimaxi.com/v1/video_generation",
    headers={
        "Authorization": f"Bearer {API_KEY}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The hardcoded external API domain confirms that the skill sends data to a third-party service. In this skill context that behavior is necessary, but it still expands the trust boundary and can expose prompts, credentials, or metadata if not clearly disclosed and constrained.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
API_KEY = os.getenv("MINIMAX_API_KEY")

response = requests.post(
    "https://api.minimaxi.com/v1/video_generation",
    headers={
        "Authorization": f"Bearer {API_KEY}",
        "Content-Type": "application/json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The status query sends a task identifier to the external provider, which is lower sensitivity than full prompts or images but still constitutes outbound data transfer. It may reveal workflow metadata and should remain within the declared trust model and permission scope.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md
# 查询状态
status_resp = requests.get(
    f"https://api.minimaxi.com/v1/query/video_generation?task_id={task_id}",
    headers={"Authorization": f"Bearer {API_KEY}"}
)
status = status_resp.json()["status"]

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The file retrieval request obtains a download URL from the third-party API, after which the skill downloads generated content. This creates both an external data flow and a potential pivot to a secondary URL, so reviewers need assurance that the destination is trusted and the resulting file is handled safely.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md
# 获取下载链接（有效期1小时，需立即下载）
    file_resp = requests.get(
        f"https://api.minimaxi.com/v1/files/retrieve?file_id={file_id}",
        headers={"Authorization": f"Bearer {API_KEY}"}
    )
    download_url = file_resp.json()["file"]["download_url"]

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This duplicate finding corresponds to the same image-upload POST request and therefore the same privacy exposure. The dangerous aspect is not the API use itself, but the off-device transfer of user images to a third party without an emphasized warning.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md
with open("start_image.jpg", "rb") as f:
    img_base64 = base64.b64encode(f.read()).decode()

response = requests.post(
    "https://api.minimaxi.com/v1/video_generation",
    headers={"Authorization": f"Bearer {API_KEY}", "Content-Type": "application/json"},
    json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This duplicate finding corresponds to the same image-upload POST request and therefore the same privacy exposure. The dangerous aspect is not the API use itself, but the off-device transfer of user images to a third party without an emphasized warning.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md
with open("start_image.jpg", "rb") as f:
    img_base64 = base64.b64encode(f.read()).decode()

response = requests.post(
    "https://api.minimaxi.com/v1/video_generation",
    headers={"Authorization": f"Bearer {API_KEY}", "Content-Type": "application/json"},
    json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This finding points to the same external image-generation API host used for uploading image-derived content. The contextual risk is elevated because the transmission can include user images, which are often more sensitive than text prompts.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

md
img_base64 = base64.b64encode(f.read()).decode()

response = requests.post(
    "https://api.minimaxi.com/v1/video_generation",
    headers={"Authorization": f"Bearer {API_KEY}", "Content-Type": "application/json"},
    json={
        "model": "MiniMax-Hailuo-2.3",

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This duplicate finding reflects the same first/last-frame upload path already identified. The context makes the transmission expected, but still sensitive because visual content can reveal identities, locations, or proprietary material.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

首尾帧生成视频

python
response = requests.post(
    "https://api.minimaxi.com/v1/video_generation",
    headers={"Authorization": f"Bearer {API_KEY}", "Content-Type": "application/json"},
    json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This duplicate finding reflects the same first/last-frame upload path already identified. The context makes the transmission expected, but still sensitive because visual content can reveal identities, locations, or proprietary material.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

首尾帧生成视频

python
response = requests.post(
    "https://api.minimaxi.com/v1/video_generation",
    headers={"Authorization": f"Bearer {API_KEY}", "Content-Type": "application/json"},
    json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This host-level finding confirms the external endpoint used for first/last-frame generation requests. The feature is legitimate, but it broadens exposure of sensitive visual data to an external processor and should therefore be treated as a real privacy/security concern.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

python
response = requests.post(
    "https://api.minimaxi.com/v1/video_generation",
    headers={"Authorization": f"Bearer {API_KEY}", "Content-Type": "application/json"},
    json={
        "model": "MiniMax-Hailuo-02",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_video.py (reported line 37)May include surrounding context.

python
if not api_key:
        raise ValueError("未设置 MINIMAX_API_KEY 环境变量")

    url = "https://api.minimaxi.com/v1/video_generation"

    payload = {
        "model": model,

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_video.py (reported line 93)May include surrounding context.

python
if not api_key:
        raise ValueError("未设置 MINIMAX_API_KEY 环境变量")

    url = "https://api.minimaxi.com/v1/video_generation"

    payload = {
        "model": model,

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_video.py (reported line 106)May include surrounding context.

python
if not api_key:
        raise ValueError("未设置 MINIMAX_API_KEY 环境变量")

    url = "https://api.minimaxi.com/v1/video_generation"

    payload = {
        "model": model,

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_video.py (reported line 78)May include surrounding context.

python
}

    print(f"正在创建视频生成任务 ({model})...")
    response = requests.post(url, json=payload, headers=headers, timeout=60)
    result = response.json()

    if result.get("base_resp", {}).get("status_code") != 0:

Tainted flow: 'download_url' from requests.get (line 114, network input) → requests.get (network output)

Medium
Category
Data Flow
Confidence
89% confidence
Finding

The code fetches a second URL returned by the API without validating the hostname, scheme, or response size. If the upstream service is compromised, misconfigured, or returns an unexpected URL, the script could be induced to contact arbitrary hosts and download attacker-controlled content, creating an SSRF-style outbound request and untrusted file write path.

Content

Scanner excerpt · scripts/generate_video.py (reported line 117)May include surrounding context.

python
download_url = result["file"]["download_url"]

    print(f"正在下载视频 (约 3-5MB)...\n")
    video_resp = requests.get(download_url, timeout=180)
    with open(save_path, 'wb') as f:
        f.write(video_resp.content)

Tainted flow: 'save_path' from os.getenv (line 227, credential/environment) → open (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/generate_video.py (reported line 118)May include surrounding context.

python
print(f"正在下载视频 (约 3-5MB)...\n")
    video_resp = requests.get(download_url, timeout=180)
    with open(save_path, 'wb') as f:
        f.write(video_resp.content)

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The workflow states that generated videos are automatically downloaded and saved locally, but this is not presented as a clear warning to users. Automatic local writes can store sensitive or inappropriate content on disk unexpectedly, creating privacy and data management risks on shared systems.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.