MiniMax Multimodal Toolkit

Generate and process speech, music, video, and images using MiniMax AI with voice cloning, custom voices, multi-scene video, and FFmpeg-based media tools.

This skill contains shell scripts that legitimately call MiniMax APIs and use FFmpeg. Before installing or running it: - Expect to provide MINIMAX_API_KEY and MINIMAX_API_HOST (SKILL.md requires these) even though the registry metadata does not list them — the metadata omission is a red flag. Ask the publisher to correct metadata if you need vetted declarations. - The scripts load .env files from the skill project root and from your current working directory and export each key=value they find. To avoid unintentionally exposing unrelated secrets, run the scripts from an isolated directory that does not contain a .env with other credentials, or remove/inspect any .env first. - check_environment.sh can print partial API key text when the key format is invalid. Avoid running these scripts where stdout/stderr is logged to systems you do not control, and avoid pasting your key into public chat. - If you proceed, use a scoped/limited MiniMax API key, test in an isolated environment (container or ephemeral VM), and rotate the key afterward. Review the scripts (they are pure bash) if you have security concerns; they only contact the documented MiniMax hosts (https://api.minimaxi.com or https://api.minimax.io) and use curl/ffmpeg/jq/xxd. Given the mismatches (metadata vs runtime) and the .env-loading behavior, treat this skill cautiously and correct or sandbox before use.

Type: OpenClaw Skill Name: yh-minimax-multimodal-toolkit Version: 1.0.0 The toolkit is a legitimate and well-structured set of Bash scripts for interacting with MiniMax multimodal APIs (TTS, Music, Video, and Image). It utilizes standard system utilities like curl, ffmpeg, jq, and xxd to handle API requests and media processing. The instructions in SKILL.md are focused on task execution and include safety-conscious directions, such as ensuring output is restricted to a specific directory and advising the agent to seek user confirmation when configuring environment variables. No evidence of data exfiltration, malicious persistence, or deceptive prompt injection was found.