mmMusicExpert

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a coherent MiniMax music-generation skill, with expected notes about using a MiniMax API key, sending prompts or lyrics to MiniMax, and saving generated audio locally.

Before installing, be comfortable providing a MiniMax API key and sending your music prompts or lyrics to MiniMax. Use a safe output folder for generated audio and monitor your MiniMax account usage.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

The skill can use the MiniMax account associated with the API key, which may consume quota or incur charges.

Why it was flagged

The script reads a local MiniMax API key and uses it as a Bearer token for API requests. This is purpose-aligned, but it is sensitive account access and the registry requirements list no required env vars.

Skill content

api_key = os.getenv("MINIMAX_MUSIC_API_KEY") ... "Authorization": f"Bearer {api_key}"

Recommendation

Only set MINIMAX_MUSIC_API_KEY if you intend to use this provider, monitor account usage, and revoke or rotate the key if you stop using the skill.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Song prompts, lyrics, and related creative details may leave the local environment and be processed by MiniMax.

Why it was flagged

The skill sends constructed music-generation payloads, including visible prompt and lyrics fields, to MiniMax's external API. This is central to the skill's purpose but is still an external data flow.

Skill content

API_URL = "https://api.minimaxi.com/v1/music_generation"

Recommendation

Avoid including private, confidential, or unreleased-sensitive material in prompts or lyrics unless you are comfortable sharing it with MiniMax under its terms.

Low

#ASI02: Tool Misuse and Exploitation

What this means

If a sensitive or existing file path is chosen, the generated audio output could overwrite that file.

Why it was flagged

Generated or downloaded audio is written to the requested output path, creating parent directories if needed. This is expected for an audio-generation tool, but it can overwrite the chosen file.

Skill content

path.parent.mkdir(parents=True, exist_ok=True)
    path.write_bytes(data)

Recommendation

Use a dedicated output folder and confirm the destination filename before running generation or download.