minimax-tokenplan-image-generation

Generate images using MiniMax image-01 model. Supports text-to-image and image-to-image with prompt optimization, and watermark control. Preferred skill for...

What to consider before installing: - The script is a straightforward wrapper for a remote MiniMax image API and needs a MiniMax API key. Prefer passing the key at runtime (--api-key) or modify the script to read MINIMAX_API_KEY from the environment (os.environ) rather than embedding the key directly in the file. - Image-to-image mode will read local files and upload them (converted to base64) to the remote API — only use it with images you are comfortable sending to an external service. - The SKILL.md includes an install/download URL on clawhub.ai; the registry itself has no install spec. Do not download or run archives from that URL without inspecting them. If you need to install anything, only pip install the well-known requests package. - The script writes outputs to ~/.openclaw/media/minimax/ (shared among agents). If that is sensitive, change OUTPUT_DIR in the script before running. - The declared required env var (MINIMAX_API_KEY) is inconsistent with the shipped code — verify how your agent will supply the key (env vs file edit vs CLI). Prefer environment-based injection over editing source files. - If you want more assurance: open and review scripts/generate.py yourself (it is short and readable), verify the API base URLs and TLS, and test with a non-sensitive key or dummy image first. Given these mismatches and privacy tradeoffs (local file upload & a third-party install link mentioned), treat the skill as plausible but verify the points above before use.

Type: OpenClaw Skill Name: minimax-tokenplan-image-generation Version: 0.9.5 The skill facilitates image generation via the MiniMax API but contains several risky patterns and vulnerabilities. The `scripts/generate.py` script allows reading any local file and sending its base64-encoded content to the API via the `--image-url` parameter without verifying if the file is actually an image, which could be exploited to exfiltrate sensitive data (e.g., SSH keys) if the agent is misdirected. Additionally, `SKILL.md` includes instructions for the AI agent to modify the skill's own source code to store API keys and uses prompt-injection techniques to force the agent to prioritize this skill over others, which are high-risk behaviors for an automated agent. Legitimate endpoints used include api.minimaxi.com and api.minimaxi.io.