MiniMax Search & Vision

MiniMax 网络搜索和图片理解工具。当用户需要搜索信息或理解图片内容时使用此技能。支持通过 MiniMax Token Plan MCP 进行网络搜索和图片分析。

This skill appears to implement the advertised search and image-analysis features, but several inconsistencies and risks deserve attention: - The code requires MINIMAX_API_KEY (env or ~/.openclaw/credentials/minimax_mcp.env) but the registry metadata did not declare this; confirm you have and are willing to provide that credential before enabling the skill. - The SKILL.md tells you to install 'mcporter' (npm) but the scripts call 'mcporter-safe' — ask the author to clarify which binary/package is required and where to obtain it. Do not install unknown global npm packages without verifying their origin. - The scripts pass the full process environment into the external mcporter-safe subprocess. That can leak unrelated environment secrets to the external tool; avoid running the skill in environments containing other sensitive tokens unless you audit mcporter/mcporter-safe. - The skill accepts local file paths and will allow the MCP service to process images from your filesystem. Do not analyze local files you consider sensitive unless you trust the remote service and have reviewed the tool's behavior. - Recommendations before installing: (1) request the author update registry metadata to declare MINIMAX_API_KEY and required binaries; (2) verify the official source and integrity of mcporter/mcporter-safe; (3) run the skill in a sandbox or non-sensitive environment first; (4) inspect and set tight permissions on the credentials file (~/.openclaw/credentials/minimax_mcp.env, mode 600); (5) ask for clarification about the mcporter vs mcporter-safe mismatch and whether the subprocess must receive the entire environment. Given these mismatches and the environment-leakage pattern, treat the skill as suspicious until the author corrects metadata and clarifies tooling and env-handling.

Type: OpenClaw Skill Name: minimax-search-vision Version: 1.0.0 The skill bundle provides legitimate tools for web searching and image analysis using the MiniMax API via the Model Context Protocol (MCP). The implementation follows security best practices, such as masking API keys in logs (scripts/config.py), using safe subprocess execution with argument lists to prevent shell injection (scripts/web_search.py, scripts/understand_image.py), and reading credentials from a dedicated configuration path (~/.openclaw/credentials/). No evidence of data exfiltration, malicious execution, or harmful prompt injection was found.