← 返回 Skills 市场
MiniMax Search & Vision
作者
xiaolongliu1988
· GitHub ↗
· v1.0.0
· MIT-0
110
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install minimax-search-vision
功能描述
MiniMax 网络搜索和图片理解工具。当用户需要搜索信息或理解图片内容时使用此技能。支持通过 MiniMax Token Plan MCP 进行网络搜索和图片分析。
安全使用建议
This skill appears to implement the advertised search and image-analysis features, but several inconsistencies and risks deserve attention:
- The code requires MINIMAX_API_KEY (env or ~/.openclaw/credentials/minimax_mcp.env) but the registry metadata did not declare this; confirm you have and are willing to provide that credential before enabling the skill.
- The SKILL.md tells you to install 'mcporter' (npm) but the scripts call 'mcporter-safe' — ask the author to clarify which binary/package is required and where to obtain it. Do not install unknown global npm packages without verifying their origin.
- The scripts pass the full process environment into the external mcporter-safe subprocess. That can leak unrelated environment secrets to the external tool; avoid running the skill in environments containing other sensitive tokens unless you audit mcporter/mcporter-safe.
- The skill accepts local file paths and will allow the MCP service to process images from your filesystem. Do not analyze local files you consider sensitive unless you trust the remote service and have reviewed the tool's behavior.
- Recommendations before installing: (1) request the author update registry metadata to declare MINIMAX_API_KEY and required binaries; (2) verify the official source and integrity of mcporter/mcporter-safe; (3) run the skill in a sandbox or non-sensitive environment first; (4) inspect and set tight permissions on the credentials file (~/.openclaw/credentials/minimax_mcp.env, mode 600); (5) ask for clarification about the mcporter vs mcporter-safe mismatch and whether the subprocess must receive the entire environment.
Given these mismatches and the environment-leakage pattern, treat the skill as suspicious until the author corrects metadata and clarifies tooling and env-handling.
功能分析
Type: OpenClaw Skill
Name: minimax-search-vision
Version: 1.0.0
The skill bundle provides legitimate tools for web searching and image analysis using the MiniMax API via the Model Context Protocol (MCP). The implementation follows security best practices, such as masking API keys in logs (scripts/config.py), using safe subprocess execution with argument lists to prevent shell injection (scripts/web_search.py, scripts/understand_image.py), and reading credentials from a dedicated configuration path (~/.openclaw/credentials/). No evidence of data exfiltration, malicious execution, or harmful prompt injection was found.
能力评估
Purpose & Capability
The skill advertises MiniMax web search and image understanding, which matches the code. However the registry metadata declares no required environment variables or binaries while the SKILL.md and code clearly require a MINIMAX_API_KEY (env or ~/.openclaw/credentials/minimax_mcp.env) and an external tool (mcporter / mcporter-safe). The metadata omission is an incoherence — a consumer would reasonably expect the primary credential and required binary to be declared.
Instruction Scope
SKILL.md and the scripts instruct reading an API key from environment or a credentials file and calling an external MCP runtime via subprocess. The code accepts local file paths for images (and checks file size), reads ~/.openclaw/credentials/minimax_mcp.env, and sets cwd to ~/.mcporter before invoking mcporter-safe. The instructions implicitly allow uploading/processing local files through an external service and do not limit what the external tool may transmit. Also the SKILL.md describes using 'mcporter' while the scripts call 'mcporter-safe' — a tooling-name mismatch that affects runtime behavior.
Install Mechanism
No install spec in registry, but SKILL.md instructs installing mcporter via npm (npm install -g mcporter). The package to run (mcporter-safe) is an external binary/tool the skill relies on; the skill does not download arbitrary code itself. Risk depends on trustworthiness of mcporter/mcporter-safe — users should verify the source and package integrity before installing globally.
Credentials
The code requires MINIMAX_API_KEY (and optionally MINIMAX_API_HOST) though the registry declared none. Worse, when launching the external tool the code builds env = { **subprocess.os.environ, 'MINIMAX_API_KEY': api_key, ... }, copying the entire process environment into the child process: this can expose unrelated environment variables (other service tokens, keys) to the external binary. The skill also accepts local file paths for images which may cause local files to be sent to the external MCP service — this is consistent with the feature but is sensitive and should be explicit in metadata and user guidance.
Persistence & Privilege
The skill does not request always:true and does not modify other skills or agent-wide settings. It does not persist itself beyond normal file presence; no elevated platform privileges are requested.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install minimax-search-vision - 安装完成后，直接呼叫该 Skill 的名称或使用
/minimax-search-vision触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
Initial release: web_search and understand_image tools with secure API key handling
元数据
常见问题
MiniMax Search & Vision 是什么？
MiniMax 网络搜索和图片理解工具。当用户需要搜索信息或理解图片内容时使用此技能。支持通过 MiniMax Token Plan MCP 进行网络搜索和图片分析。 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 110 次。
如何安装 MiniMax Search & Vision？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install minimax-search-vision」即可一键安装，无需额外配置。
MiniMax Search & Vision 是免费的吗？
是的，MiniMax Search & Vision 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
MiniMax Search & Vision 支持哪些平台？
MiniMax Search & Vision 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 MiniMax Search & Vision？
由 xiaolongliu1988（@xiaolongliu1988）开发并维护，当前版本 v1.0.0。
推荐 Skills