minimax-tokenplan-music

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:34 AM UTC
• Version: 0.9.0

Overview

This MiniMax music skill does what it advertises, but it asks users to store API keys in skill files and can forward those keys and user content to an arbitrary configured endpoint.

Review before installing. Use this only if you are comfortable sending music prompts, lyrics, and chosen reference audio to MiniMax. Do not paste or store API keys in `SKILL.md` or `scripts/generate.py`; prefer an environment variable or secret store. Avoid using `--base-url` except for the documented MiniMax domains.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate.py:266

Finding

Unrestricted API Endpoint Override Can Expose Credentials and User Content

Content

View full analysis

Vulnerability Details

File Location: scripts/generate.py:266-275, scripts/generate.py:479-494
Vulnerability Type: Unrestricted network destination with credential forwarding
Risk Level: High

Vulnerable Code

python

resp = requests.post(
    f"{base_url}/v1/music_generation",
    headers={
        "Authorization": f"Bearer {api_key}",
        "Content-Type": "application/json",
    },
    json=payload,
    timeout=timeout,
)

python

parser.add_argument(
    "--base-url",
    default=None,
    help="API Base URL（默认使用文件顶部配置）"
)

python

final_api_key = args.api_key if args.api_key else API_KEY
final_base_url = args.base_url if args.base_url else BASE_URL

Technical Analysis

The --base-url argument accepts an arbitrary string without validating its scheme, hostname, port, or relationship to the approved MiniMax API domains. The selected URL is subsequently used as the destination of an authenticated HTTP request.

Every music-generation request sends the API key in the Authorization header. Depending on the selected operation, the JSON body can also contain prompts, lyrics, externally supplied audio URLs, or Base64-encoded local reference audio. The implementation does not require HTTPS and does not restrict requests to api.minimaxi.com or api.minimaxi.io.

This is not evidence of a deliberately hidden exfiltration mechanism: sending content to MiniMax is necessary for the declared cloud-based generation functionality, and local audio encoding is documented. However, permitting an arbitrary endpoint exceeds the minimum network privileges required for that functionality.

Attack Path

1. An attacker, malicious instruction, or untrusted wrapper influences the command used to invoke the Skill.
2. The invocation includes an attacker-controlled endpoint, such as --base-url http://attacker.example.
3. The user or environment supplies a valid A ...[truncated 936 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove --base-url unless custom endpoints are essential.
2. If the option must remain, allow only exact approved origins:
   • https://api.minimaxi.com
   • https://api.minimaxi.io
3. Parse the URL with a standard URL parser and reject:
   • Plaintext HTTP.
   • Embedded usernames or passwords.
   • Unapproved hostnames and ports.
   • IP literals and ambiguous hostname forms.
   • Query strings or fragments in the configured base URL.
4. Disable redirects, or validate every redirect destination against the same allowlist before forwarding credentials.
5. Never forward the Authorization header across origins.
6. Require explicit user confirmation before uploading a local audio file.
7. Add tests proving that malformed URLs, HTTP URLs, deceptive subdomains, and redirect-based bypasses are rejected.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate.py:38

Finding

Initialization Workflow Persists API Credentials in Plaintext Skill Files

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:71-76, SKILL.md:84-88, scripts/generate.py:38-39
Vulnerability Type: Plaintext credential storage
Risk Level: Medium

Vulnerable Code

python

API_KEY = "YOUR_API_KEY_HERE"
BASE_URL = "https://api.minimaxi.com"  # CN: api.minimaxi.com, Global: api.minimaxi.io

The initialization instructions direct the operator or Agent to replace API_KEY in scripts/generate.py with the real credential and update the configuration table in SKILL.md as a configuration record.

Technical Analysis

The Skill metadata declares MINIMAX_API_KEY as a required environment variable, but the implementation does not read that variable. Instead, the documented initialization workflow instructs the Agent to write the API key directly into executable source and potentially duplicate it in the Markdown configuration record.

Source and documentation files are inappropriate secret-storage locations. They may be copied into backups, included in archives, exposed during troubleshooting, read by other users or processes, or accidentally committed to version control.

Passing the key through --api-key avoids source modification but can also expose it through shell history or process listings. Environment-based or operating-system-backed secret retrieval is safer.

Attack Path

1. The user provides a valid MiniMax API key during initialization.
2. Following the documented workflow, the Agent replaces YOUR_API_KEY_HERE in scripts/generate.py.
3. The key may also be copied into the configuration table in SKILL.md.
4. The Skill directory is subsequently inspected, archived, synchronized, backed up, shared, or committed.
5. Another local user, process, repository reader, or archive recipient obtains the plaintext key.
6. The exposed credential is used to make unauthorized MiniMax API requests.

Impact Assessment

The exposed credential grants whatever MiniM ...[truncated 394 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the source-level secret with environment retrieval:

python

API_KEY = os.environ.get("MINIMAX_API_KEY")

2. Remove all instructions that tell users or Agents to place actual credentials in scripts/generate.py or SKILL.md.
3. Never record the credential value in a configuration table. Record only whether credential configuration is present.
4. Prefer an operating-system credential store or a dedicated secret manager where available.
5. Retain --api-key only if necessary and warn that command-line secrets may appear in process listings or shell history.
6. Restrict permissions on any local secret configuration file to the owning user.
7. Add secret-scanning checks to prevent API keys from being committed or packaged.
8. Rotate any real key that has already been stored in or distributed with these files.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:48

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:48-50, scripts/generate.py:30-34
Vulnerability Type: Uncontrolled third-party dependency resolution
Risk Level: Low

Vulnerable Code

bash

pip3 install requests

python

try:
    import requests
except ImportError:
    print("[ERROR] 缺少 requests 库，请运行: pip3 install requests", file=sys.stderr)
    sys.exit(1)

Technical Analysis

The installation instructions request the latest resolvable version of requests without a version constraint, lock file, hash verification, isolated environment, or explicitly trusted package index.

This does not establish that the current requests package is malicious. The risk arises because the exact installed artifact can change after the Skill is audited. Package-index configuration, future dependency changes, or a compromised release could therefore alter installation-time or runtime behavior.

Attack Path

1. A user follows the documented pip3 install requests instruction.
2. Pip resolves packages using the user's configured index and current dependency metadata.
3. A compromised index, compromised future release, or unsafe resolver configuration supplies an unintended artifact.
4. Package installation code executes with the privileges of the invoking user.
5. The Skill later imports and executes the installed package during every run.

Impact Assessment

A malicious dependency could execute arbitrary Python code with the privileges of the user running pip or the Skill. That could expose files and environment variables accessible to that user, including the MiniMax API key.

The practical likelihood is reduced because requests is a well-known package and no typosquatted package name or demonstrably malicious dependency was identified. The finding concerns reproducibility and supply-chain hardening rather than a confirmed malicious package.

Remediation

View remediation

Remediation Suggestions

1. Pin a reviewed requests version in a dependency file.
2. Pin transitive dependencies or generate a lock file.
3. Use hash-verified installation, such as a requirements file with --require-hashes.
4. Install dependencies inside a dedicated virtual environment rather than the global Python environment.
5. Use an explicitly trusted package index and avoid untrusted additional indexes.
6. Add automated dependency vulnerability and update monitoring.
7. Document a controlled update process so dependency changes receive review before release.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description explains the generation features but does not clearly warn that user prompts, lyrics, and reference audio may be transmitted to MiniMax over the network. In this context, the skill has network access and supports local-file audio upload, so omission of this disclosure materially weakens informed consent and could expose sensitive content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill advertises itself as the preferred/default tool for essentially any music-related request, including very generic terms. This can cause unintended invocation and data transfer to an external provider even when the user did not explicitly choose this service, increasing privacy and consent risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The operational instructions and initialization workflow are presented only in Chinese, and the skill provides no indication that users may choose another language or locale. This can violate language/locale policy when a skill effectively constrains interaction language without explicit opt-in or documented regional justification.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The init workflow instructs the agent to collect the user's API key and then persist it both in scripts/generate.py and in the ## 配置 table inside the skill documentation. Storing secrets in code and docs creates durable secret exposure risk, makes accidental disclosure more likely, and is especially dangerous in a shared workspace or version-controlled environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This outbound HTTP request transmits user prompt data and the API key to an external service. External transmission is expected for this feature, but it still represents a true security/privacy concern because the code allows override of base_url, which can redirect sensitive content and credentials to an attacker-controlled endpoint if misconfigured or abused.

Content

Scanner excerpt · scripts/generate.py (reported line 102)May include surrounding context.

python

}

    try:
        resp = requests.post(
            f"{base_url}/v1/lyrics_generation",
            headers={
                "Authorization": f"Bearer {api_key}",

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script sends user-provided prompts to a third-party lyrics generation API without any explicit consent flow, privacy notice, or data minimization controls. In this skill context, prompts and generated lyrical content may contain sensitive or proprietary user data, so silent transmission to an external service creates a real privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

In cover mode, the script reads a local audio file, base64-encodes it, and uploads it to a remote API with no explicit warning or consent checkpoint. Local audio can contain sensitive speech, copyrighted material, or personal recordings, so this behavior materially increases privacy, compliance, and data-exfiltration risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This request sends prompts, lyrics, and potentially uploaded reference audio to a remote API along with the bearer API key. In this skill, the data can include local file contents and creative/user-supplied material, so the combination of external transmission plus user-controllable base_url makes credential leakage and unintended data exfiltration more dangerous.

Content

Scanner excerpt · scripts/generate.py (reported line 267)May include surrounding context.

python

# ---------- 发送请求 ----------
    try:
        resp = requests.post(
            f"{base_url}/v1/music_generation",
            headers={
                "Authorization": f"Bearer {api_key}",