MiniMax套餐查询

获取 MiniMax 平台的套餐信息，包括套餐名称、额度、当前使用情况。当用户询问 MiniMax 套餐、额度使用情况、API 调用量、计费信息时使用此技能。

This skill will open a local browser and scrape the MiniMax billing page for plan/usage information. However, its code also searches the page text for API-key-like strings (regex for 'sk-cp-...') and will print/return any matches — a sensitive behavior that is not documented in SKILL.md. Before installing or running: 1) Inspect the script yourself or ask the publisher to explicitly disclose API-key extraction and whether keys are stored, transmitted, or logged. 2) If you want only plan/usage info, remove or disable the api_key extraction lines in scripts/get_plan.py (the JS evaluation and the regex for sk-cp-...). 3) Run the script in a trusted, isolated environment and do not run it while unrelated accounts/pages are open in the same browser profile (the script can read any DOM the browser can access). 4) Consider changing prints to redact keys (e.g., show only last 4 chars) and avoid returning secrets in machine-readable results. If the publisher cannot justify extracting keys, treat this as a reason not to use the skill.

Type: OpenClaw Skill Name: minimax-plan-checker Version: 1.0.0 The script `scripts/get_plan.py` intentionally extracts sensitive API keys (matching the pattern `sk-cp-[a-zA-Z0-9]+`) from the MiniMax platform page using regex and DOM selectors, despite this capability not being disclosed in the `SKILL.md` description. While the script runs in a non-headless browser and lacks explicit exfiltration logic, the silent collection of credentials that are then returned to the AI agent is a high-risk behavior. Additionally, `SKILL.md` contains a hardcoded absolute path to a specific local user directory (`C:\Users\YangF\...`), which is highly unusual for a shared skill bundle.