安全扫描
OpenClaw
可疑
medium confidenceThe skill generally does what it says (web search and image analysis via a MiniMax API) but it reads local OpenClaw auth files that weren't declared and will upload image content and use an external API host with no homepage or publisher information — these mismatches merit caution.
评估建议
This skill appears to perform MiniMax web search and image analysis by calling an external API (DEFAULT_HOST https://api.minimaxi.com). Before installing:
- Be aware the script will upload image contents (base64) and your queries to that external host.
- The code will look for an API key in MINIMAX_API_KEY or by reading OpenClaw auth-profiles.json files from several locations (OPENCLAW_AUTH_PROFILES_JSON, OPENCLAW_AGENT_DIR, OPENCLAW_HOME, ~/.openclaw, /home/admin/.openclaw). Confirm you are com...详细分析 ▾
ℹ 用途与能力
The code implements web_search and understand_image endpoints against a MiniMax API host, matching the skill's stated purpose. It also attempts to obtain a MiniMax API key from MINIMAX_API_KEY or from OpenClaw auth profile files, which is reasonable for an API client. However the skill metadata declared no required environment variables even though MINIMAX_API_KEY is used at runtime.
⚠ 指令范围
Runtime behavior is mostly within scope (sending queries and image data to the MiniMax API). Concerns: the code will read multiple candidate auth-profiles.json files from OpenClaw agent dirs (OPENCLAW_AUTH_PROFILES_JSON, OPENCLAW_AGENT_DIR, OPENCLAW_HOME, ~/.openclaw, and /home/admin/.openclaw). While it only extracts specific fields for a minimax profile, scanning those locations can expose other sensitive agent configuration files and tokens to the skill's logic. The script also fetches remote image URLs (downloading arbitrary user-supplied URLs) and base64-uploads image content to the external API — expected for image understanding but important to be aware of.
✓ 安装机制
No install spec; the skill is instruction/code-only and runs the included Python script. Nothing is downloaded at install time and no additional packages or network installers are invoked.
⚠ 凭证需求
Registry metadata claims no required env vars, but the runtime uses MINIMAX_API_KEY and several OpenClaw environment variables (OPENCLAW_AUTH_PROFILES_JSON, OPENCLAW_AGENT_DIR, OPENCLAW_HOME) to find auth profiles. Requesting access to agent auth profiles (which may contain other credentials) is broader than the skill metadata indicates and should have been declared and justified.
✓ 持久化与权限
The skill does not request always:true, does not write to system-wide configs, and does not persist new credentials. It runs on demand and does not change other skills' configurations.
安全有层次,运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.1.12026/3/7
Remove build artifacts and keep the public package portable across OpenClaw installs.
● 可疑
安装命令 点击复制
官方npx clawhub@latest install minimax-coding-plan
镜像加速npx clawhub@latest install minimax-coding-plan --registry https://cn.clawhub-mirror.com
技能文档
Use the local wrapper:
bash {baseDir}/scripts/minimax-plan.sh [args...]
Available tools:
web_search --query "..."understand_image --prompt "..." --image-source /path/to/file-or-url
Recommended routing:
- Use this skill when the user explicitly wants MiniMax-native search or MiniMax-native image understanding.
- For ordinary web research,
tavily-searchis still the general-purpose default. - If the main
minimax-portaltext model path is not exposed as a reliable image route in the current OpenClaw setup, useunderstand_image.
Examples:
bash {baseDir}/scripts/minimax-plan.sh web_search --query "MiniMax M2.5 release note"
bash {baseDir}/scripts/minimax-plan.sh understand_image --prompt "Describe the UI in this screenshot" --image-source /tmp/screen.png
bash {baseDir}/scripts/minimax-plan.sh understand_image --prompt "Extract the visible text" --image-source https://example.com/image.png
Notes:
- This wrapper first uses
MINIMAX_API_KEYwhen present. Otherwise it looks for an existingminimax-portalOAuth profile inOPENCLAW_AUTH_PROFILES_JSON,OPENCLAW_AGENT_DIR,OPENCLAW_HOME, or~/.openclaw. - Output is JSON. For image analysis, read
contentfirst. Ifbase_resp.status_code != 0, explain the MiniMax API error plainly. - Supported image formats: JPEG, PNG, WebP.
数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制