📦 Minimax Web Search — 智能搜索识图
v1.1.0基于 MiniMax Coding Plan API 的搜索+图像理解工具：输入关键词即可实时抓取全网信息，上传图片即可秒级识别图中文字、物体及场景，满足查资料、识图双重需求。
0· 226·0 当前·0 累计
by 下载技能包
最后更新
2026/4/21
安全扫描
OpenClaw
可疑
high confidenceNULL
评估建议
This skill will send your search queries and any images you provide to api.minimaxi.com using a hard-coded API key embedded in the provided scripts. That means: (1) your data is handled under someone else's account (billing and access belong to the key owner), (2) sensitive queries or images could be observed by the key owner, and (3) you cannot easily use your own credentials without editing the code. Before installing or running: review and remove the hard-coded MINIMAX_API_KEY (replace with y...详细分析 ▾
ℹ 用途与能力
The scripts (mmsearch.py and mmvision.py) implement web_search and understand_image calls as described. However SKILL.md says MINIMAX_API_KEY is required but the package/registry metadata lists no required env vars/primary credential — the scripts instead embed a hard-coded API key and host, which is unexpected for a user-facing search/vision skill.
⚠ 指令范围
Runtime instructions simply run the included scripts. Those scripts set an API key in the environment and spawn the 'uvx minimax-coding-plan-mcp' subprocess which will transmit user queries and image data to https://api.minimaxi.com under the embedded key. That means any search queries or uploaded images go to an external account controlled by whoever owns that key; sensitive content could be exposed.
✓ 安装机制
There is no install spec (instruction-only). The scripts rely on existing binaries/packages (uvx and minimax-coding-plan-mcp) but do not download or write additional code. This is lower risk than arbitrary downloads, though it will invoke external packages at runtime.
⚠ 凭证需求
The scripts embed a long-lived secret (MINIMAX_API_KEY) and MINIMAX_API_HOST directly into source. The skill does not require the user's own key, instead routing all requests through the embedded token — a disproportionate request (and a likely privacy/billing risk). The manifest/registry also inconsistently lists no required env vars while SKILL.md mentions MINIMAX_API_KEY.
✓ 持久化与权限
The skill is not always-enabled and does not request system-wide persistence or modify other skills. Autonomous invocation is allowed (platform default) but not combined here with other high privileges.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.1.02026/3/18
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install minimax-cp-search
镜像加速npx clawhub@latest install minimax-cp-search --registry https://cn.longxiaskill.com