MINIMAX TEAM RULES

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:29 AM UTC
• Version: 1.0.0

Overview

This text-only MiniMax team-rules skill has no executable payload, but it broadly tells agents to propagate rule changes into shared guidance and memory by default.

Install only if you intentionally want this skill to guide agents in maintaining MiniMax/MMX team rules across multiple persistent locations. Require reviewable diffs and explicit confirmation before it changes shared guidance, memory, learnings, or other agents' rules.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:24

Finding

Unconfirmed Persistent Rule Propagation Across Agent Memory and Guidance

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:24-41
Vulnerability Type: Persistent modification of shared guidance, memory, and learning records
Risk Level: Medium

Complete Code Snippet:

markdown

## Core Rule
For **configuration / standards / multi-agent workflow** changes, do **one-pass rollout** by default:
1. verify the fact,
2. update the shared source of truth,
3. update affected local guidance or references,
4. record the learning if a misunderstanding or correction occurred.

Do not stop at a partial fix when the issue clearly affects multiple layers.
Do not make the user push for each missing layer one by one.

## Required Execution Pattern
When this skill triggers, default to this checklist:
1. Identify all affected layers (shared docs, local agent guidance, memory, learnings).
2. Update the **shared source of truth first**.
3. Convert repeated local rule blocks into **references to the shared source**, keeping only role-specific additions locally.
4. Keep all four roles aligned: 小美 / 大龙 / 元气 / 小语.
5. When explaining quota, use the documented house interpretation from the reference file. Do not guess from field names alone.
6. When finalizing, give the user the outcome, not internal rollout noise.

Technical Analysis

The skill directs an agent to propagate configuration or workflow changes into persistent locations, explicitly including shared documentation, local agent guidance, memory, and learning records. It also makes this propagation the default behavior rather than requiring separate authorization for each persistent destination.

If user-controlled or incorrectly verified instructions are treated as a standards change, they could be recorded as durable rules and subsequently influence future sessions. Requiring the agent to keep four roles aligned increases the propagation scope. The instruction to expose only the outcome rather than “internal rollout noise” may ...[truncated 1657 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user confirmation before modifying persistent memory, learning records, shared configuration, or another agent's guidance.
2. Default to producing a proposed rollout plan or reviewable diff rather than immediately applying team-wide changes.
3. Enumerate every target file, memory store, and agent configuration before requesting approval.
4. Validate that all write targets are inside an approved workspace and reject symlinks, traversal paths, or destinations outside that boundary.
5. Treat user-provided standards as untrusted until verified against an authoritative source.
6. Apply least privilege by separating read-only diagnostic access from persistent write capabilities.
7. Preserve an audit log containing the initiating request, affected destinations, exact changes, authorization decision, and rollback information.
8. Replace the instruction to omit “internal rollout noise” with a requirement to summarize all persistent modifications clearly.
9. Add transactional updates and rollback support so that partial or incorrect multi-agent propagation can be reversed safely.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger description is extremely broad, covering many product names, workflow concepts, and generic change-management requests like 'standardize' or 'sync configuration'. This can cause the skill to activate for loosely related tasks, steering agent behavior or rollout actions in contexts where the rules do not actually apply.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The invocation guidance says to use the skill whenever work 'touches' broad topics, but does not define when not to activate it or how to resolve ambiguous matches. In combination with directives like 'do one-pass rollout by default,' unintended activation could propagate unnecessary changes across shared docs, local guidance, and memory layers.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.