Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

minimaxmusic

v1.0.0

使用 MiniMax API 生成创意音乐。当用户要求生成音乐、创作歌曲、制作背景音乐时使用。支持纯音乐和人声歌曲,可指定风格、情绪和场景。

0· 57·0 current·0 all-time
byxiaohuozi@279458179
Security Scan
Capability signals
Crypto
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description and SKILL.md consistently describe calling a music-generation REST API (model music-2.6) and returning generated audio. That capability aligns with the stated purpose. However, the sample requests use an Authorization header (Bearer <API_KEY>) while the skill metadata lists no required environment variables or primary credential — this mismatch is unexpected.
Instruction Scope
The instructions are self-contained and limited to constructing a JSON request to https://api.minimaxi.com/v1/music_generation, checking the API response, downloading the returned audio URL, and sending it to the user. The instructions do not ask the agent to read local files, shell history, or unrelated system state.
Install Mechanism
This is instruction-only with no install spec and no code to write to disk, which is the lowest-risk install profile.
!
Credentials
The SKILL.md clearly expects an API key in the Authorization header, but the skill metadata declares no required env vars or primary credential. That omission is a notable incoherence: the skill will need a credential to function, yet it does not declare one for reviewers or for the platform to provision/guard. The skill also does not document required token scope or billing implications.
Persistence & Privilege
always is false and the skill is user-invocable only. It does not request persistent privileges or make changes to other skills or system-wide configuration.
What to consider before installing
This skill appears to be an instruction-only wrapper for a third-party music-generation API and will need an API key to work. Before installing or using it: (1) verify the API domain (api.minimaxi.com) and its legitimacy; (2) require the skill author to declare a primaryEnv (e.g., MINIMAX_API_KEY) so the platform can manage the secret rather than you pasting it ad hoc; (3) check billing/usage rules for the API (the docs mention 'insufficient balance'); and (4) avoid providing high-privilege or unrelated credentials. If you need higher assurance, ask the author for a homepage/source repo or an official provider link and for the skill metadata to be updated to explicitly declare the required API key and expected token scope.

Like a lobster shell, security has layers — review code before you run it.

latestvk97drpj1580n22e3q35mwkg23n84q035
57downloads
0stars
1versions
Updated 1w ago
v1.0.0
MIT-0

MiniMax 音乐生成

快速开始

API 端点

POST https://api.minimaxi.com/v1/music_generation

请求格式 (PowerShell)

$json = @{
    model = "music-2.6"
    prompt = "音乐描述(风格、情绪、场景)"
    is_instrumental = $true  # $false = 带歌词的人声歌曲
    output_format = "url"   # 返回 URL 而非 hex
    lyrics = "歌词内容"      # 仅非纯音乐时需要
} | ConvertTo-Json -Compress

Invoke-RestMethod -Uri "https://api.minimaxi.com/v1/music_generation" -Method Post -Headers @{
    Authorization = "Bearer <API_KEY>"
} -ContentType "application/json" -Body ([System.Text.Encoding]::UTF8.GetBytes($json)) -TimeoutSec 180

参数说明

参数必填说明
model使用 music-2.6
prompt音乐描述,1-2000字符,如"流行音乐,欢快,适合广告背景"
is_instrumental$true=纯音乐,$false=人声歌曲(默认)
lyrics歌词,使用\n分隔行,支持标签[Verse] [Chorus]
output_formaturl(推荐)或hex,默认hex
audio_setting音频设置:sample_rate(44100), bitrate(256000), format(mp3)

响应示例

{
  "data": {
    "audio": "https://...",
    "status": 2
  },
  "extra_info": {
    "music_duration": 142576,  // 毫秒
    "music_sample_rate": 44100,
    "bitrate": 256000
  },
  "base_resp": { "status_code": 0, "status_msg": "success" }
}

工作流程

  1. 构建 JSON 请求体
  2. 调用 API(超时建议 180 秒)
  3. 检查 base_resp.status_code === 0
  4. 下载音频文件(URL 有效期 24 小时)
  5. 发送给用户

常见错误

  • invalid params: 参数格式错误,检查 JSON 结构和必填字段
  • insufficient balance: 余额不足
  • model: xxx not support: Token 未开通该模型权限

提示词技巧

  • 纯音乐: is_instrumental: $true,prompt 示例:独立民谣,忧郁,内省,渴望,独自漫步,咖啡馆
  • 人声歌曲: is_instrumental: $false,提供 lyrics,prompt 示例:流行音乐,欢快,青春校园
  • 歌词标签: [Verse] [Chorus] [Pre-Chorus] [Bridge] [Interlude] [Outro]

Comments

Loading comments...