minimax-image

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:47 AM UTC
• Version: 1.0.0

Overview

The skill does what it claims, but its documented command examples can expose the MiniMax API key through command-line arguments.

Review before installing. Use MINIMAX_API_KEY from the environment and do not pass the API key with --api-key. Do not submit confidential prompts, private image URLs, signed URLs, or regulated data to MiniMax. Prefer a pinned dependency lockfile before production use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:55

Finding

API Credential Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:55-59
Vulnerability Type: API credential exposure through process arguments
Risk Level: Medium

The documented usage instructs users to expand the MiniMax API key directly into a command-line argument:

bash

python3 scripts/minimax_image_create.py \
  --api-key $MINIMAX_API_KEY \
  --model image-01 \
  --prompt "一只可爱的橘猫" \
  --aspect-ratio 16:9

The script explicitly supports receiving the credential through that argument at scripts/minimax_image_create.py:232-237:

python

parser.add_argument(
    "--api-key",
    type=str,
    default=os.environ.get("MINIMAX_API_KEY"),
    help="MiniMax API Key (或设置环境变量 MINIMAX_API_KEY)"
)

Technical Analysis

When the documented command is executed, the shell expands $MINIMAX_API_KEY before starting Python. The resulting secret can therefore appear in the process argument vector. Depending on operating-system configuration and local monitoring controls, command-line arguments may be observable through process inspection utilities, /proc interfaces, audit systems, crash diagnostics, or endpoint telemetry.

Sending the API key to https://api.minimaxi.com/v1/image_generation as a Bearer token is necessary for the declared image-generation functionality. The vulnerability is not the authenticated network request itself; it is the unnecessary command-line exposure before the credential reaches the API client. The implementation already supports loading the credential from MINIMAX_API_KEY, so passing it as an argument is not required.

Attack Path

1. A user exports a valid MiniMax API key and follows the documented command.
2. The shell expands $MINIMAX_API_KEY into the Python process argument list.
3. A malicious or compromised local process, process-monitoring service, or telemetry collector records the argument list while the command is running.
4. The attacker extracts the Bear ...[truncated 727 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove --api-key $MINIMAX_API_KEY from every command example. Document invocation without the credential argument:

   bash

   export MINIMAX_API_KEY="your-api-key"
   python3 scripts/minimax_image_create.py \
     --model image-01 \
     --prompt "a requested image" \
     --aspect-ratio 16:9
   

2. Prefer removing the --api-key option entirely and accept the secret only through MINIMAX_API_KEY or a protected secret-management integration.
3. If an explicit input mechanism is required, read the credential from protected standard input without echoing it rather than placing it in the argument vector.
4. Ensure errors and diagnostic logging never include request headers or the complete API key.
5. Advise users who previously used the documented argument form to review process telemetry exposure and rotate potentially disclosed keys.

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unbounded Third-Party Dependency Version

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-4
Vulnerability Type: Unpinned dependency and non-reproducible dependency resolution
Risk Level: Low

The project permits installation of any current or future requests version newer than the specified minimum:

text

# Python dependencies for MiniMax Image Generation skill
# Install with: pip install -r requirements.txt

requests>=2.25.0

Technical Analysis

The lower-bound-only constraint does not identify a reviewed release, provide a lockfile, or verify package hashes. Consequently, installations performed at different times can resolve to different dependency versions. This widens the supply-chain and compatibility surface by allowing future, unreviewed releases to enter the runtime automatically.

The dependency name is legitimate and there is no evidence that the project currently references a malicious or typosquatted package. The risk arises from weak dependency integrity controls rather than a confirmed compromise of requests.

Attack Path

1. A user or deployment pipeline runs pip install -r requirements.txt.
2. The package resolver selects the newest release satisfying requests>=2.25.0.
3. If a future selected release or one of its transitive dependencies is compromised, the malicious package is downloaded from the configured package index.
4. Malicious behavior may execute during installation or when the Skill imports requests.
5. The code runs with the permissions of the user or service account executing the Skill.

This path depends on a compromised dependency release, package index, or dependency-resolution environment; no such compromise was found in the audited files.

Impact Assessment

In the worst case, compromised dependency code could execute with the Skill process's local permissions. It could access environment variables—including MINIMAX_API_KEY—read files available to that account, alter ...[truncated 210 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin requests and all transitive dependencies to reviewed versions through a reproducible lockfile.
2. Generate hash-verified requirements and install with pip install --require-hashes.
3. Use an approved package index or internal dependency mirror with provenance and integrity controls.
4. Add automated dependency vulnerability and update scanning.
5. Review and deliberately update locked versions instead of accepting every future release automatically.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill documents use of environment variables and outbound network access to a third-party API, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent environment, missing scope declarations can cause overbroad execution privileges or make reviewers unaware that secrets and network egress are required.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The natural-language description and usage guidance are presented in Chinese only, which can violate a language/locale policy when no user opt-in or justified regional scope is provided. The file does not state that the skill is intended only for Chinese-speaking users or offer an alternative language option.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

API 参考

端点: POST https://api.minimaxi.com/v1/image_generation

请求头:

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script transmits user-provided prompts and optional input image URLs to a third-party service without an explicit disclosure at the point of use. In a skill context, users may unknowingly send sensitive text, internal URLs, or proprietary image references to an external provider, creating privacy and data-governance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

This call sends the prompt and related generation parameters to an external API endpoint, which is expected for the skill's function but still constitutes data exfiltration outside the local environment. In security terms, the risk is contextual: if users provide sensitive prompts or regulated content, that data leaves the trust boundary and may be logged or retained by the provider.

Content

Scanner excerpt · scripts/minimax_image_create.py (reported line 178)May include surrounding context.

python

# 调用 API (文生图)
    if not input_image:
        response = requests.post(
            f"{BASE_URL}/v1/image_generation",
            headers=headers,
            json=data,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

In image-to-image mode, the script sends externally supplied image references along with prompt data to the third-party API. This is more sensitive than plain text generation because image URLs may reveal internal locations, private assets, or signed resource links, increasing privacy and information-disclosure risk in the skill context.

Content

Scanner excerpt · scripts/minimax_image_create.py (reported line 186)May include surrounding context.

python

)
    else:
        # 图生图使用不同的端点
        response = requests.post(
            f"{BASE_URL}/v1/image_generation",
            headers=headers,
            json=data,

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency is specified as requests>=2.25.0, which allows installation of many different future or legacy versions and makes builds non-reproducible. This increases supply-chain risk and can unintentionally pull a vulnerable release, especially because the skill relies on an external HTTP client library.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

# Python dependencies for MiniMax Image Generation skill
# Install with: pip install -r requirements.txt

requests>=2.25.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

The manifest references requests without pinning an exact version, while the package has multiple known advisories across its release history. Because the resolved version is unverifiable from this file, deployments may install a version affected by issues such as credential leakage or other request-handling flaws.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Comments, help text, and console output are primarily in Chinese, which imposes a specific language on users of the skill. There is no opt-in, alternative locale, or stated justification that this tool is intended only for a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The inline comments state that MiniMax image-to-image should use a different API endpoint, yet both branches send requests to /v1/image_generation. This is an active contradiction between the code documentation and the implemented behavior, even though it appears functional rather than overtly dangerous.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.