MINIMAX TEAM RULES

• Outcome: Review
• Latest audit: May 29, 2026 at 9:36 PM UTC
• Version:
  1.0.0

Overview

The skill appears to be a MiniMax workflow helper, but its instructions can push broad, persistent changes across shared agent guidance and memory without tight scoping.

Review before installing. Use it only for intentional MiniMax/team configuration work, and require it to list the exact files, guidance layers, and memory/learnings it plans to update before making changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger description is overly broad and includes generic terms like standardize, document, align, fix once-for-all, and sync configuration/workflow across multiple agents or files. This can cause the skill to activate for unrelated tasks and inject team-routing or rollout behavior into contexts where it is not appropriate, increasing the chance of unintended instruction precedence and cross-file modifications.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The activation and execution rules for configuration, standards, and multi-agent workflow changes are ambiguous and encourage broad one-pass rollout across shared docs, local guidance, memory, and learnings. If invoked in the wrong context, this could drive unnecessary or unauthorized propagation of changes across multiple layers, magnifying mistakes and making prompt-scope creep more dangerous.

VirusTotal

65/65 vendors flagged this skill as clean.