Minimax API

Provides image analysis and description from URLs or local files plus real-time web search using MiniMax's Token Plan API.

Key points to consider before installing: - Credential declaration mismatch: The skill actually requires a MiniMax API key (scripts use --api-key and SKILL.md references MINIMAX_API_KEY), but the registry metadata lists no required env var/primary credential. Ask the publisher to fix metadata or code so it's clear how the agent supplies the key. Do not assume the platform will inject a secret unless the skill metadata declares it. - Usage mismatch: The SKILL.md examples show exporting MINIMAX_API_KEY and running the script without --api-key, but the Python scripts require --api-key. This will cause runtime errors or confusion when integrated; request a corrected SKILL.md or code that reads the env var when present. - Data exfiltration/privacy: For local files, the script reads the file and encodes it as a data URL (base64) and sends it to https://api.minimaxi.com. That is necessary for remote image analysis but is effectively uploading the entire file to a third party. Avoid providing sensitive images or grant the skill access only to non-sensitive paths. - Source provenance: The skill has unknown source/homepage. Prefer skills with a verifiable maintainer, repository, or homepage. Verify the domain api.minimaxi.com is legitimate for the service you expect. - Secret handling: Do not pass API keys on the command line if others can view shell history/process list; prefer secure secret storage offered by the platform (and confirm how the agent will supply the key). If you must export to a shell, be aware of shell history and ~/.bashrc persistence implications. - Operational fix suggestions: Require the publisher to (1) declare MINIMAX_API_KEY in registry metadata as a required/primary credential, (2) either accept the env var in the scripts (fallback from MINIMAX_API_KEY) or update SKILL.md to require passing --api-key, and (3) provide a verified homepage or source repository. Given these inconsistencies (missing declared credential and conflicting usage instructions) and the privacy implications of uploading local files, treat this skill cautiously until the publisher corrects metadata and usage guidance.

Type: OpenClaw Skill Name: minimax-api Version: 1.0.3 The skill provides image analysis and web search capabilities via the MiniMax API. The script `scripts/minimax_image.py` allows the agent to read arbitrary local files and transmit their base64-encoded content to an external endpoint (api.minimaxi.com). While this behavior is documented for the purpose of analyzing local images, the lack of file-type validation or path restrictions poses a risk of data exfiltration if the agent is manipulated into reading sensitive system files (e.g., SSH keys or configuration files) instead of images.