Trust Assessment
minimax-usage received a trust score of 82/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Discrepancy in .env file location and sourcing, Unquoted API key in curl Authorization header.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 12, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Discrepancy in .env file location and sourcing The `SKILL.md` documentation instructs the user to create a `.env` file in "the same directory as the script". However, the `minimax-coding-plan-usage.sh` script attempts to source the `.env` file from two directories up (`../../.env`). This discrepancy means the skill will not function as documented unless the `.env` is placed in a higher-level directory, potentially a shared location for multiple skills. This introduces a supply chain risk as the skill relies on an external, potentially shared configuration file whose content might not be specific to this skill or could be manipulated by other skills/users if not properly isolated. If the `../../.env` file contains sensitive credentials for other services or malicious commands, this skill could inadvertently access or execute them. 1. **Align Documentation and Code**: Either update the `SKILL.md` to accurately reflect the `../../.env` path, or, preferably, modify the script to source `./.env` (i.e., `source "$(dirname "$0")/.env"`) and ensure the `.env` file is placed within the skill's directory for better isolation. 2. **Isolate Secrets**: For production environments, avoid shared `.env` files. Use platform-managed secret stores or environment variables that are explicitly passed to the skill. | LLM | minimax-coding-plan-usage.sh:5 | |
| MEDIUM | Unquoted API key in curl Authorization header The `API_KEY` variable is directly interpolated into the `curl` command's `Authorization` header without being quoted. If the `MINIMAX_CODING_API_KEY` environment variable (sourced from `.env`) were to contain shell metacharacters (e.g., `$(command)`, `"; command"`), it could lead to command injection, allowing arbitrary commands to be executed. While API keys are typically alphanumeric, this is a general shell scripting vulnerability pattern. Always quote variables when interpolating them into shell commands to prevent word splitting and globbing. Change `authorization: Bearer $API_KEY` to `authorization: Bearer "$API_KEY"`. | LLM | minimax-coding-plan-usage.sh:16 |
Scan History
Embed Code
[](https://skillshield.io/report/080e3c89f632c03f)
Powered by SkillShield