Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Minimax-backed web search helper with expected network and API-key use, but users should treat search queries as data sent to a third party.
Install this only if you are comfortable using Minimax for web search. Do not include secrets, credentials, private customer data, or sensitive business terms in search queries, because the query is sent to the external Minimax API using your MINIMAX_API_KEY.
The skill invokes a Node.js script that uses both environment variables and outbound network access, but the manifest does not declare any tool scope or permission boundary. This weakens reviewability and least-privilege controls, making it easier for the skill to access sensitive environment data or transmit data externally without explicit user or platform awareness.
The documentation explains how to run searches but does not warn users that their queries are sent to an external third-party API. Search queries may contain sensitive business terms, secrets, or personal data, so failing to disclose external transmission creates a privacy and data-handling risk.
The script hard-codes user-facing output labels in Chinese such as "搜索结果", "链接", "摘要", and "相关搜索". This imposes a specific language on all users with no opt-in or locale-selection mechanism, which is a natural-language policy concern under the language/locale rule.
The natural-language content of the skill description and examples is entirely in Chinese, while the file does not indicate that the skill is region-specific or provide any language opt-in or alternative. Under the policy, forcing a specific language without user choice can be a locale-policy violation.
Detected: suspicious.env_credential_access
