understand-image-minimax

图片理解技能，使用 Minimax Coding Plan VLM API 分析图片

Before installing, note three things: (1) The script expects MINIMAX_API_KEY in the environment but the registry metadata doesn't list it — the skill will fail or behave insecurely unless you set that key. (2) When invoked it will read local image files you pass (or download URLs) and send the full image (base64) to https://api.minimaxi.com; do not allow it to automatically run on sensitive images or folders. (3) Verify you trust the Minimax service and that the API key has appropriate, limited permissions; consider running the skill in a sandboxed environment, reviewing the included script, and ensuring the agent won't auto-invoke the skill on images you don't intend to upload. If you want tighter assurance, ask the publisher to update registry metadata to declare MINIMAX_API_KEY and provide a trustworthy homepage/source for the API.

Type: OpenClaw Skill Name: understand-image-minimax Version: 1.0.0 The skill uses a Node.js script (`scripts/understand.cjs`) to analyze images via the Minimax VLM API (api.minimaxi.com). It possesses risky capabilities including reading environment variables (MINIMAX_API_KEY), performing outbound network requests, and reading arbitrary local files. While these are necessary for its stated function, the implementation lacks path sanitization, which could allow an agent to be tricked into reading and exfiltrating sensitive system files. Per the provided criteria, these risky but plausibly necessary capabilities warrant a suspicious classification.