Minimax Usage

• Risk level: Low
• Analyzed: Feb 24, 2026, 8:09 AM
• Findings: 0
• Version: 1.0.1

Overview

The code matches the stated purpose (querying MiniMax Coding Plan usage) and appears non-malicious, but the package metadata omits the required API credential and there are small inconsistencies (OS/filename references and registry reading) that make the bundle internally inconsistent.

This script appears to do what it says: it calls the MiniMax usage API with a bearer token and prints alerts. However, before installing/running: - Note the metadata omission: the package registry metadata declares no required environment variables or primary credential, but the script requires MINIMAX_CODING_KEY. Expect to supply that key manually; don't rely on metadata for permissions. - The script will try to read HKEY_CURRENT_USER\Environment on Windows to auto-load MINIMAX_CODING_KEY. If you prefer not to allow any registry reads, set the key in the session environment only (e.g., export or $env:MINIMAX_CODING_KEY) and/or inspect the script before running. - Confirm the API endpoint domain (https://www.minimaxi.com/v1/...) is the official MiniMax endpoint you expect. If unsure, verify from the vendor console. - The code does not exfiltrate data to other domains, but you should still review the source (check_minimax.py) yourself before using it with a real API key. - Prefer temporary/session-level environment variables rather than making permanent user-level environment changes, and run the script in a controlled environment the first time (local machine or isolated container). If you want to proceed: set MINIMAX_CODING_KEY, pip install requests, and consider correcting the registry metadata (declaring the required env var) if you publish or share this skill so automated reviewers and users are not misled.