MiniMax GIF Sticker Maker

Convert photos (people, pets, objects, logos) into 4 animated GIF stickers with captions. Use when: user wants to create cartoon stickers, GIF expressions, e...

Before installing or running this skill, consider the following: - Inconsistency: The manifest lists no environment variables or code files, but SKILL.md requires MINIMAX_API_KEY and several local scripts and asset files. Verify the package actually includes scripts/*, assets/*, references/* and requirements.txt or obtain them from a trusted source before running. - Privacy: The workflow explicitly uploads user photos (and for people instructs preserving facial likeness). Only proceed if you have the user's informed consent and you trust the MiniMax service (review its privacy policy and data retention rules). Avoid uploading sensitive photos or faces without explicit permission. - Credential safety: Do not provide your MiniMax API key unless you trust the publisher and have inspected the scripts that will use it. Ideally inspect scripts/minimax_*.py to confirm they call only the expected endpoints and do not exfiltrate other data. - Missing install instructions: The skill expects a Python virtualenv and ffmpeg. Install those from official sources and inspect requirements.txt before pip-installing dependencies. - Output formatting rule: The SKILL.md requires a strict <deliver_assets> block and forbids any text after it. This could hide status or error information — make sure you understand how the agent will report errors and verify outputs on disk. - Operational impact: The instructions ask to run four generation jobs concurrently; this can consume significant CPU/memory and count against any API rate limits or billing on the MiniMax account. If you cannot verify the missing scripts/assets and the API endpoint behavior, treat this skill as incomplete and do not provide credentials or sensitive images. If you want to proceed, request the publisher supply the missing files and a clear install script, then audit those files before use.

Type: OpenClaw Skill Name: minimax-gif-sticker Version: 1.0.0 The skill bundle provides a workflow for generating animated stickers using MiniMax AI APIs, but it contains a significant shell injection vulnerability in its instructions. SKILL.md directs the agent to construct shell commands by embedding user-provided captions directly into command-line arguments for Python scripts (e.g., `python3 scripts/minimax_image.py "<prompt>"`). Because there are no instructions to sanitize these captions, a malicious user could provide input containing shell metacharacters (like backticks or command substitutions) to execute arbitrary code on the host system. While the overall intent appears to be a legitimate creative tool, the lack of input sanitization for shell-executed strings is a critical security flaw.