MiniMax TTS 国内版

PassAudited by ClawScan on May 1, 2026.

Overview

This skill appears to perform the stated MiniMax text-to-speech function, with expected use of a MiniMax API key and external API calls.

Install/use this only if you are comfortable sending the text you convert to MiniMax and using a MiniMax API key from your environment. Check that the Python requests package is available because the registry metadata does not fully declare the skill's prerequisites.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

Using the skill may consume the user's MiniMax account quota or billing and relies on keeping the API key private.

Why it was flagged

The script reads a MiniMax API key from the environment and uses it as a bearer token for MiniMax API requests. This is expected for the service, but it is still account credential use.

Skill content

key = os.environ.get("MINIMAX_API_KEY") ... "Authorization": f"Bearer {api_key}"

Recommendation

Use a dedicated MiniMax API key if possible, keep it out of shared logs or prompts, and rotate it if it is exposed.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Any text converted to speech is transmitted to MiniMax, so sensitive or confidential text may leave the local environment.

Why it was flagged

The user-provided text is sent to the external MiniMax API to generate speech. This is central to the skill's purpose, but it is an external data flow.

Skill content

url = f"{API_BASE}/v1/t2a_v2" ... data = { "model": model, "text": text, ... } ... requests.post(url, headers=headers, json=data, timeout=60)

Recommendation

Avoid sending confidential text unless MiniMax's account, retention, and privacy terms are acceptable for the content.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

The skill may fail until the user manually provides the API key and Python dependency, and automated review may not surface those requirements clearly.

Why it was flagged

The registry metadata does not declare the runtime prerequisites that SKILL.md/code indicate are needed, including python3, requests, and MINIMAX_API_KEY. This may reduce installer visibility into setup needs.

Skill content

Required binaries (all must exist): none ... Required env vars: none ... Primary credential: none ... No install spec — this is an instruction-only skill.

Recommendation

Before use, verify python3 and requests are available and set MINIMAX_API_KEY only in a trusted environment.