MiniMax Coding Plan

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:20 AM UTC
• Version: 0.1.1

Overview

This MiniMax integration is mostly purpose-aligned, but it gives the wrapper broad network and credential-bearing upload behavior that users should review before installing.

Install only if you trust the MiniMax endpoint configuration and the agents that will invoke this skill. Avoid giving it sensitive local screenshots or private-network image URLs unless you are comfortable sending that content to MiniMax, and do not use an untrusted MINIMAX_API_HOST value.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/minimax_plan.py:84

Finding

Arbitrary Image URL Fetching Enables Server-Side Request Forgery

Content

View full analysis

Vulnerability Details

File Location: scripts/minimax_plan.py, lines 84–89
Vulnerability Type: Server-Side Request Forgery (SSRF) and unbounded response handling
Risk Level: High

python

if image_source.startswith(("http://", "https://")):
    req = urllib.request.Request(image_source, headers={"User-Agent": "OpenClaw-MiniMax-Plan/1.0"})
    with urllib.request.urlopen(req, timeout=30) as resp:
        data = resp.read()
        mime = detect_mime(image_source, resp.headers.get("Content-Type", ""))
    encoded = base64.b64encode(data).decode("utf-8")
    return "data:%s;base64,%s" % (mime, encoded)

Technical Analysis

The --image-source argument is treated as a URL and fetched from the Agent's network context without validating its hostname or resolved IP address. The implementation does not reject loopback, link-local, private, reserved, or cloud metadata destinations. Redirects are followed by the underlying URL handler without revalidating the final destination.

The response is read without a byte limit and is not verified as a valid JPEG, PNG, or WebP image. Unsupported or non-image content falls back to image/jpeg, allowing arbitrary HTTP response bodies to be Base64-encoded and submitted to the MiniMax image-analysis endpoint.

Base64 encoding itself is necessary for the declared image-understanding feature and is not covert behavior. The vulnerability arises because arbitrary remote content can be fetched and subsequently transmitted without destination, content, or size controls.

Attack Path

1. An attacker causes the Skill to run understand_image with an attacker-selected URL.
2. The URL points directly to an internal service, loopback endpoint, private-network host, or a public endpoint that redirects to one.
3. The wrapper sends an HTTP request from the Agent's trusted network environment.
4. The complete response is read into memory without a size limit.
5. The respo ...[truncated 977 chars]

Remediation

View remediation

Remediation Suggestions

• Prefer accepting local image files and preapproved HTTPS image hosts rather than arbitrary URLs.
• Require HTTPS and enforce an explicit hostname allowlist where remote retrieval is necessary.
• Resolve the hostname before connecting and reject loopback, link-local, private, multicast, reserved, and unspecified IP ranges for both IPv4 and IPv6.
• Disable redirects or validate every redirect destination using the same hostname and resolved-address checks.
• Protect against DNS rebinding by ensuring that the validated address is the address used for the connection.
• Enforce a conservative maximum response size using Content-Length where available and bounded incremental reads in all cases.
• Reject unexpected content types and decode the response with a trusted image library to verify its actual format before forwarding it.
• Restrict supported formats to the documented JPEG, PNG, and WebP types instead of defaulting arbitrary content to JPEG.
• Run URL retrieval in a network sandbox that cannot reach internal services or cloud metadata endpoints.
• Return a clear validation error when a source violates these controls.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/minimax_plan.py:108

Finding

Unrestricted API Host Override Can Exfiltrate Stored MiniMax Credentials and User Content

Content

View full analysis

Vulnerability Details

File Location: scripts/minimax_plan.py, line 11 and lines 108–118
Vulnerability Type: Unvalidated credential-bearing network destination
Risk Level: Medium

python

DEFAULT_HOST = os.environ.get("MINIMAX_API_HOST", "https://api.minimaxi.com").rstrip("/")

python

def post_json(endpoint, payload):
    body = json.dumps(payload).encode("utf-8")
    req = urllib.request.Request(
        "%s%s" % (DEFAULT_HOST, endpoint),
        data=body,
        headers={
            "Authorization": "Bearer %s" % load_api_key(),
            "Content-Type": "application/json",
            "MM-API-Source": SOURCE_HEADER,
        },
    )

Technical Analysis

MINIMAX_API_HOST can replace the legitimate MiniMax API origin with an arbitrary URL. The configured value is not restricted to HTTPS, validated against an allowlist, or checked before the wrapper attaches the Authorization bearer token.

The credential can come from MINIMAX_API_KEY or from a persistent OpenClaw authentication profile discovered by the wrapper. Consequently, control over this environment variable can redirect both the credential and request payload to an attacker-controlled endpoint. Search requests contain user queries, while image-analysis requests contain prompts and Base64-encoded image data.

A configurable API endpoint can be legitimate in development or enterprise deployments, but unrestricted redirection of persistent credentials is not the minimum privilege necessary for the declared MiniMax integration. The host override is also not documented in SKILL.md.

Attack Path

1. An attacker or unsafe deployment configuration sets MINIMAX_API_HOST to an attacker-controlled HTTP or HTTPS server.
2. A user invokes web_search or understand_image.
3. The wrapper loads a MiniMax credential from MINIMAX_API_KEY or an OpenClaw authentication profile.
4. post_json constructs a reques ...[truncated 936 chars]

Remediation

View remediation

Remediation Suggestions

• Remove MINIMAX_API_HOST if custom endpoints are not required.
• Otherwise, validate the parsed URL before loading or attaching any credential.
• Require HTTPS and reject URLs containing user information, fragments, unexpected ports, or non-HTTP schemes.
• Enforce an explicit allowlist of trusted MiniMax API hostnames and, where possible, approved ports and certificate identities.
• Do not send a production credential to development, proxy, or custom endpoints by default.
• Require a separate, explicitly configured credential for each nonstandard endpoint.
• Ensure redirects cannot forward an authenticated request to an untrusted origin; preferably disable redirects for API POST requests.
• Document the host override, its trust implications, and the exact data transmitted.
• Consider requiring explicit user or administrator opt-in before loading credentials from persistent OpenClaw profiles.
• Apply least-privilege scopes and rotation procedures to MiniMax credentials so that exposure has limited impact.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tainted flow: 'req' from os.environ.get (line 110, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/minimax_plan.py (reported line 94)May include surrounding context.

python

return image_source
    if image_source.startswith(("http://", "https://")):
        req = urllib.request.Request(image_source, headers={"User-Agent": "OpenClaw-MiniMax-Plan/1.0"})
        with urllib.request.urlopen(req, timeout=30) as resp:
            data = resp.read()
            mime = detect_mime(image_source, resp.headers.get("Content-Type", ""))
        encoded = base64.b64encode(data).decode("utf-8")

Tainted flow: 'req' from os.environ.get (line 110, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/minimax_plan.py (reported line 120)May include surrounding context.

python

},
    )
    try:
        with urllib.request.urlopen(req, timeout=60) as resp:
            return json.loads(resp.read().decode("utf-8"))
    except urllib.error.HTTPError as exc:
        body = exc.read().decode("utf-8", errors="replace")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill invokes a local wrapper that can use environment variables, read local files, and perform network requests, but it declares no explicit tool scope or permissions. This creates an authorization gap: the orchestrator and reviewers cannot clearly constrain or audit what capabilities the skill is expected to use, increasing the risk of unintended data access or exfiltration through image paths, OAuth profile discovery, or web search.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The image-understanding path will fetch arbitrary http(s) URLs provided by the caller before forwarding the content to the MiniMax API. In an agent setting, this creates a generic URL retrieval primitive that can be abused for SSRF-style access to internal services, cloud metadata endpoints, or other network-reachable resources beyond the skill’s intended role.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill transmits supplied local image files or fetched remote image content to a third-party MiniMax endpoint without any built-in disclosure or confirmation mechanism. In an agent workflow, users may not realize that sensitive screenshots, documents, or intranet-hosted images are being exfiltrated off-box to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The code reads sensitive credentials from MINIMAX_API_KEY and local auth profile stores, but there is no comment, help text, or other user-facing disclosure that the tool accesses stored tokens. This can surprise users in environments where credential access should be explicit.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.