MiniMax AI音乐生成

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:45 AM UTC
• Version: 1.0.0

Overview

The skill mostly does what it says, but it ships a hardcoded MiniMax API credential and sends user prompts and lyrics to a third-party API without clear privacy warnings or consent guidance.

Review before installing. Use only with non-sensitive prompts and lyrics, replace the embedded MiniMax key with your own securely provided key, and avoid batch generation or merging unless you understand which files will be uploaded, downloaded, written, or overwritten. The publisher should revoke the exposed key and add explicit privacy and permission disclosures.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate.py:19

Finding

Hardcoded MiniMax API Credential

Content

View full analysis

Vulnerability Details

File Location: scripts/generate.py:19
Vulnerability Type: Hardcoded bearer credential
Risk Level: High

Vulnerable Code

python

# ============ 配置 ============
API_KEY = "sk-cp-F-oQWZsbhwv06vJlTx0ZdpsYS4lj6_SexMokhjTvL5I08cwoPHb22r49qvecJjxt8Qn1LHsIRlVJn12WLJjF9GIdjOcqJqyf8jSd33YhcYb3E9XciwvlrXM"
API_BASE = "https://api.minimaxi.com/v1"
DEFAULT_TIMEOUT = 600  # 600秒，等待音乐生成

The credential is subsequently placed into authorization headers in scripts/generate.py:27-30 and scripts/generate.py:48-51:

python

headers = {
    "Content-Type": "application/json",
    "Authorization": f"Bearer {API_KEY}"
}

Technical Analysis

A live-looking MiniMax API bearer credential is embedded directly in distributable source code. Anyone with read access to the repository, a copied Skill package, an archive, a build artifact, or source history can recover and reuse it without executing the Skill.

Sending a bearer token to the documented MiniMax endpoint is necessary for API authentication. Bundling a shared credential in the Skill is not necessary, however, and violates secret-management and least-privilege principles. Bearer credentials generally grant access based on possession alone, so source-code exposure is sufficient for unauthorized use.

The key must be treated as compromised. Merely deleting it from the current file would not remove it from existing copies or version-control history.

Attack Path

1. An attacker downloads, clones, or otherwise obtains read access to the Skill.
2. The attacker inspects scripts/generate.py and extracts the credential from line 19.
3. The attacker constructs requests with:

   http

   Authorization: Bearer [extracted credential]
   

4. The attacker submits requests directly to the MiniMax APIs independently of the Skill.
5. Requests consume the credential owner's available quota or account funds until the key is revoked, restricted, or exhausted.

No local code exe ...[truncated 844 chars]

Remediation

View remediation

Remediation Suggestions

1. Revoke and rotate the exposed credential immediately. Assume that it has already been copied. Review API usage records for unexpected requests, quota consumption, or charges.

2. Remove the credential from source code and version-control history. Purge it from prior commits and distributed artifacts where feasible. Rotation remains mandatory because history rewriting cannot invalidate existing copies.

3. Load credentials from a protected runtime source, such as an environment variable or secret manager:

   python

   import os
   
   API_KEY = os.environ.get("MINIMAX_API_KEY")
   if not API_KEY:
       raise RuntimeError(
           "MINIMAX_API_KEY is required. Configure it through the environment."
       )
   

4. Require each user to supply their own credential. Do not distribute a shared project-owned bearer token.

5. Apply provider-side restrictions where supported, including minimum API/model scope, spending limits, rate limits, expiration, and usage alerts.

6. Prevent recurrence by enabling pre-commit and continuous-integration secret scanning, defining credential patterns, and blocking commits that contain API keys.

7. Avoid logging credentials or complete authorization headers. Ensure exceptions, debug output, and HTTP tracing redact bearer tokens.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (26)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared skill purpose focuses on music generation, but the body also includes undeclared behaviors such as downloading remote content to disk and merging arbitrary local audio files via ffmpeg. This mismatch is dangerous because reviewers and users may approve the skill for a narrow content-generation purpose without realizing it can perform broader local file and shell operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README instructs users to send prompts, lyrics, and song content to the MiniMax external API using an API key, but it does not warn that this content is transmitted to a third-party service. Users may unknowingly submit sensitive personal, proprietary, or regulated content, creating privacy, confidentiality, and compliance risks.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest describes this as a music-generation skill triggered for generating music, lyrics, songs, and batch BGM samples. README line L11 claims the skill also generates cover images using an image model, which is a distinct capability outside the manifest's declared music-focused behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill documentation demonstrates network access, local file writes, and shell-based ffmpeg usage, but the skill declares no explicit tool scope or permissions. This creates an authorization gap where a host agent may permit broader capabilities than users or reviewers expect, increasing the risk of unintended file modification, external data transfer, or command execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases include broad everyday expressions such as '生成音乐' and '写首歌', which can cause the skill to activate in contexts where the user did not intend external API use or file generation. In a skill that can send prompts off-platform and write files, overbroad activation increases the chance of accidental data disclosure or unintended actions.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The documentation explicitly references the external lyrics_generation endpoint, signaling that the skill depends on third-party transmission. Merely naming the endpoint is lower risk than executing a call, but it still confirms a data egress behavior that should be disclosed and scoped.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

歌词生成

接口: POST https://api.minimaxi.com/v1/lyrics_generation

python

payload = {

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation instructs sending prompts and lyrics to an external MiniMax API but provides no privacy notice or warning that user-supplied text will leave the local environment. This is risky because users may provide sensitive personal, proprietary, or copyrighted material without informed consent to third-party processing.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The documented music_generation endpoint indicates external processing of prompts and possibly lyrics. This is expected functionality, but without disclosure and controls it can still surprise users and cause unintentional data sharing.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

歌曲生成

接口: POST https://api.minimaxi.com/v1/music_generation

纯音乐（无人声）

python

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

This endpoint reference occurs in executable example context where user content is posted externally, so it represents a real data-egress concern. The skill context makes it more dangerous because the examples encourage direct inclusion of free-form prompts that may contain sensitive text.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

md

"prompt": "给唐晓加油打气的古风歌曲，温暖励志",
    "title": "赠唐晓"
}
r = requests.post("https://api.minimaxi.com/v1/lyrics_generation",
    headers=headers, json=lyrics_payload, timeout=60)
lyrics = r.json()["lyrics"]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

This endpoint reference occurs in executable example context where user content is posted externally, so it represents a real data-egress concern. The skill context makes it more dangerous because the examples encourage direct inclusion of free-form prompts that may contain sensitive text.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

md

"prompt": "给唐晓加油打气的古风歌曲，温暖励志",
    "title": "赠唐晓"
}
r = requests.post("https://api.minimaxi.com/v1/lyrics_generation",
    headers=headers, json=lyrics_payload, timeout=60)
lyrics = r.json()["lyrics"]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

This endpoint reference occurs in executable example context where user content is posted externally, so it represents a real data-egress concern. The skill context makes it more dangerous because the examples encourage direct inclusion of free-form prompts that may contain sensitive text.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

md

"prompt": "给唐晓加油打气的古风歌曲，温暖励志",
    "title": "赠唐晓"
}
r = requests.post("https://api.minimaxi.com/v1/lyrics_generation",
    headers=headers, json=lyrics_payload, timeout=60)
lyrics = r.json()["lyrics"]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

This executable example sends lyrics and prompt data to the music generation endpoint, exposing the user's content to a third-party processor. Because song lyrics can encode personal, confidential, or copyrighted material, the external transfer is materially security-relevant.

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

md

"lyrics": lyrics,
    "output_format": "url"
}
r = requests.post("https://api.minimaxi.com/v1/music_generation",
    headers=headers, json=song_payload, timeout=600)
audio_url = r.json()["data"]["audio"]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

This executable example sends lyrics and prompt data to the music generation endpoint, exposing the user's content to a third-party processor. Because song lyrics can encode personal, confidential, or copyrighted material, the external transfer is materially security-relevant.

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

md

"lyrics": lyrics,
    "output_format": "url"
}
r = requests.post("https://api.minimaxi.com/v1/music_generation",
    headers=headers, json=song_payload, timeout=600)
audio_url = r.json()["data"]["audio"]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

This executable example sends lyrics and prompt data to the music generation endpoint, exposing the user's content to a third-party processor. Because song lyrics can encode personal, confidential, or copyrighted material, the external transfer is materially security-relevant.

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

md

"lyrics": lyrics,
    "output_format": "url"
}
r = requests.post("https://api.minimaxi.com/v1/music_generation",
    headers=headers, json=song_payload, timeout=600)
audio_url = r.json()["data"]["audio"]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

This batch example references the endpoint inside a loop, confirming repeated remote submission behavior. The volume and automation make accidental over-sharing or excessive remote usage more likely than a single manual request.

Content

Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.

md

]
urls = []
for p in prompts:
    r = requests.post("https://api.minimaxi.com/v1/music_generation",
        headers=headers,
        json={"model":"music-2.6","prompt":p,"is_instrumental":True,"output_format":"url"},
        timeout=600)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

This batch example references the endpoint inside a loop, confirming repeated remote submission behavior. The volume and automation make accidental over-sharing or excessive remote usage more likely than a single manual request.

Content

Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.

md

]
urls = []
for p in prompts:
    r = requests.post("https://api.minimaxi.com/v1/music_generation",
        headers=headers,
        json={"model":"music-2.6","prompt":p,"is_instrumental":True,"output_format":"url"},
        timeout=600)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

This batch example references the endpoint inside a loop, confirming repeated remote submission behavior. The volume and automation make accidental over-sharing or excessive remote usage more likely than a single manual request.

Content

Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.

md

]
urls = []
for p in prompts:
    r = requests.post("https://api.minimaxi.com/v1/music_generation",
        headers=headers,
        json={"model":"music-2.6","prompt":p,"is_instrumental":True,"output_format":"url"},
        timeout=600)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

A hard-coded API credential is embedded directly in the script and used for outbound requests. Anyone with access to the skill source can extract and abuse the key, leading to unauthorized API usage, billing fraud, account compromise, and difficulty rotating exposure once the skill is distributed.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 5)May include surrounding context.

md

# ============ 配置 ============
API_KEY = "sk-cp-F-oQWZsbhwv06vJlTx0ZdpsYS4lj6_SexMokhjTvL5I08cwoPHb22r49qvecJjxt8Qn1LHsIRlVJn12WLJjF9GIdjOcqJqyf8jSd33YhcYb3E9XciwvlrXM"
API_BASE = "https://api.minimaxi.com/v1"
DEFAULT_TIMEOUT = 600  # 600秒，等待音乐生成

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate.py (reported line 19)May include surrounding context.

python

# ============ 配置 ============
API_KEY = "sk-cp-F-oQWZsbhwv06vJlTx0ZdpsYS4lj6_SexMokhjTvL5I08cwoPHb22r49qvecJjxt8Qn1LHsIRlVJn12WLJjF9GIdjOcqJqyf8jSd33YhcYb3E9XciwvlrXM"
API_BASE = "https://api.minimaxi.com/v1"
DEFAULT_TIMEOUT = 600  # 600秒，等待音乐生成

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 83% confidence

Finding

The script sends user-provided lyric prompts and optional song titles to an external API endpoint. In the context of a music-generation skill this network transmission is expected, but it still creates a data-exposure risk because user content is forwarded to a third party without any visible consent, minimization, or warning.

Content

Scanner excerpt · scripts/generate.py (reported line 34)May include surrounding context.

python

payload["title"] = title

    print(f"  [歌词] 生成中: {prompt[:30]}...")
    r = requests.post(f"{API_BASE}/lyrics_generation",
                     headers=headers, json=payload, timeout=timeout)
    data = r.json()
    if data.get("base_resp", {}).get("status_code") != 0:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

The script transmits prompts and potentially full generated lyrics to the external music-generation API. While this is functionally aligned with the skill's purpose, it can expose sensitive user content or copyrighted text to a remote service if users are not informed.

Content

Scanner excerpt · scripts/generate.py (reported line 60)May include surrounding context.

python

payload["is_instrumental"] = False

    print(f"  [歌曲] 生成中（约2-5分钟）...")
    r = requests.post(f"{API_BASE}/music_generation",
                     headers=headers, json=payload, timeout=timeout)
    data = r.json()
    if data.get("base_resp", {}).get("status_code") != 0:

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest describes generating lyrics, synthesizing songs, and batch-generating sample tracks via the MiniMax API. However, the code also provides a separate local post-processing mode that merges arbitrary MP3 files by invoking ffmpeg through subprocess, which is a distinct media-manipulation capability not mentioned in the skill description.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate.py (reported line 100)May include surrounding context.

python

output_path
    ]
    print(f"  [合并] 执行 ffmpeg 合并 {len(files)} 个文件...")
    result = subprocess.run(cmd, capture_output=True, text=True)
    os.remove(list_file)
    if result.returncode != 0:
        raise Exception(f"ffmpeg 合并失败: {result.stderr}")

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

Natural-language policy issues apply to all file types, including markdown. This README presents the operational instructions entirely in Chinese and does not indicate that the skill is region-specific or offer users a language/locale choice, which can amount to forcing a specific language without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.