MiniMax Search & VLM

使用 MiniMax Coding Plan API 进行网络搜索和图片理解。使用场景：(1) 用户需要搜索实时信息或新闻，(2) 需要分析图片内容，(3) 做研究或查找资料。无需 API key：用户需自行配置。

This skill appears to perform the search and image-analysis tasks it describes, but pay attention before installing: (1) the SKILL.md requires you to create and source a MINIMAX_API_KEY file (~/.openclaw/config/minimax-api.env), yet the registry entry does not declare that credential — confirm you are comfortable providing an API key. (2) There is no homepage or known source for the skill or the MiniMax service in the metadata; verify the api.minimaxi.com domain and the developer/platform before sharing keys or uploading sensitive images. (3) If you proceed, use a dedicated, limited-scope API key (not a reused account key), avoid sending highly sensitive images, and monitor usage. If the publisher updates the registry to explicitly declare MINIMAX_API_KEY and provides verifiable source/homepage or documentation, that would reduce my concern; absence of provenance keeps this in the 'suspicious' bucket.

Type: OpenClaw Skill Name: minimax-search-vlm Version: 1.0.0 The skill demonstrates powerful capabilities that, while plausibly needed for its stated purpose, introduce significant security risks. Specifically, the `SKILL.md` shows how to read arbitrary local files using `base64 -w0 $IMG_PATH` and send their content to an external API, and how to download files from arbitrary URLs using `curl -o /tmp/tmp_img.jpg`. These primitives, if the agent's input sanitization is insufficient, could be exploited for arbitrary file exfiltration or writing, making the skill highly vulnerable to misuse or prompt injection against the agent's execution environment. There is no clear evidence of intentional malicious behavior, but the inherent risks are substantial.