Security audit

minimax-tokenplan-music

Security checks for vulnerabilities and agentic risk

Overview

This music-generation skill is mostly purpose-aligned, but its setup tells agents to store a MiniMax API key in local code and documentation files.

Install only if you are comfortable reviewing the setup manually. Do not paste your MiniMax API key into SKILL.md or generate.py; use an environment variable or a local secret manager instead, and only provide local audio files you are willing to upload to MiniMax for cover generation.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The initialization section instructs the operator to manually edit `scripts/generate.py` to insert the API key and then record that key in the `## 配置` section of the documentation. Embedding secrets in source files and documentation creates a strong risk of credential leakage through local files, logs, screenshots, backups, sync tools, or later publication of the skill directory.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The README tells the operator to collect a user's API key, place it into configuration constants, and record it in the configuration table, without any warning against persistent storage or exposure. This materially increases the chance that sensitive credentials are copied into files that may be retained, shared, or inspected by other agents or users.

Static analysis

No suspicious patterns detected.