MiniMax MMX

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:26 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent MiniMax CLI helper, but it asks users to install an unpinned global CLI and enter API keys on the command line without enough safety guidance.

Install only if you trust the `mmx-cli` npm package and MiniMax service. Prefer a pinned/local install, avoid entering API keys directly in command lines or agent chats, and do not send confidential prompts, images, or search queries unless you intend to share them with the external provider.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:3

Finding

Unpinned Global Installation of a Third-Party CLI Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:3
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code Snippet:

bash

npm install -g mmx-cli

Technical Analysis

The skill instructs users to install the mmx-cli npm package globally without specifying a reviewed version, integrity hash, lockfile, verified publisher, or trusted repository. Consequently, the installed implementation can change independently of the reviewed skill.

npm package installation may execute lifecycle scripts, while a global installation places executable files in shared command locations. The actual CLI implementation is not included in this project, so its credential handling, network behavior, filesystem access, update logic, and installation scripts cannot be verified through this audit.

This creates a supply-chain risk if the package is compromised, transferred to an untrusted publisher, replaced by a malicious release, or unexpectedly modified in a future version.

Attack Path

1. An attacker compromises the npm package publisher account, package repository, or release process.
2. The attacker publishes a malicious version under the expected mmx-cli package name.
3. A user or Agent follows the skill instruction and runs npm install -g mmx-cli.
4. npm resolves the latest available release rather than a previously reviewed version.
5. Malicious lifecycle code may execute during installation, or a malicious global mmx executable may be installed.
6. The malicious package subsequently runs with the privileges of the installing or invoking user.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. Depending on that account's privileges and environment, the package could access user-readable files, environment variables, authentication material, shell configuration, Agent workspaces, a ...[truncated 134 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the CLI to a specific reviewed version, such as mmx-cli@X.Y.Z.
• Document the official package publisher and source repository so users can verify provenance.
• Verify package integrity using an approved lockfile, registry integrity metadata, signatures, or reproducible release artifacts.
• Prefer a project-local installation over a global installation to reduce system-wide impact.
• Review package lifecycle scripts and the transitive dependency tree before recommending installation.
• Introduce an explicit review and controlled upgrade process instead of automatically adopting the latest release.
• Avoid elevated installation privileges and execute the CLI in a restricted environment with only the filesystem and network access required for the task.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:3

Finding

API Key Exposure Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Locations: SKILL.md:3, SKILL.md:11, and references/commands.md:9
Vulnerability Type: Sensitive credential passed as a command-line argument
Risk Level: Medium

Vulnerable Code Snippets:

bash

mmx auth login --api-key <key>

bash

mmx auth login --api-key <your-api-key>

bash

mmx auth login [--method oauth|api-key] [--api-key <key>]

Technical Analysis

The documentation directs users to place an API key directly in a command-line argument. After the placeholder is replaced with a real key, the secret may become visible through shell history, process inspection facilities, terminal recording, CI/CD logs, debugging output, audit telemetry, or Agent conversation transcripts.

Argument exposure is particularly relevant in shared systems because command lines may be observable by other local users or monitoring agents. Even after the command terminates, persistent shell history, job logs, or transcripts can retain the credential.

No actual credential is hardcoded in the audited files. The vulnerability is the documented secret-handling method, which encourages users to expose a real credential through an unsafe channel.

Attack Path

1. A user replaces the documented placeholder with a valid MiniMax API key.
2. The user runs the command in a shell, CI job, recorded terminal, or Agent-managed execution environment.
3. The complete command, including the key, is retained in shell history, logs, process metadata, telemetry, or an Agent transcript.
4. Another local user, log reader, monitoring service, or transcript recipient obtains the recorded command.
5. The exposed key is submitted to the MiniMax service by the unauthorized party.
6. The attacker consumes account quota or accesses capabilities and data available to that credential until it is revoked or expires.

Impact Assessment

Exploitation does not directly g ...[truncated 356 chars]

Remediation

View remediation

Remediation Suggestions

• Replace command-line secret arguments with hidden interactive input that does not echo or persist the key.
• Alternatively, accept the key through standard input, an operating-system credential store, or a securely permissioned secret file.
• If environment-variable support is unavoidable, document its process and logging exposure and ensure the value is never printed.
• Explicitly warn users not to enter API keys in Agent prompts, chat transcripts, shell commands, source files, or CI command lines.
• Ensure authentication commands redact secrets from errors, debug output, telemetry, and generated configuration.
• Store resulting credentials with restrictive file permissions and use the platform's secure credential storage where available.
• Add key rotation and immediate revocation guidance for credentials that may already have been exposed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The manifest description and the full documentation are written only in Chinese, including example voice selection such as '中文主播', with no indication that users may choose another language or that the skill is intentionally region- or locale-specific. This creates a natural-language locale constraint without opt-in or justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description is broadly scoped to many common user intents such as image generation, search, text chat, and media creation, which increases the chance an agent will invoke it for routine requests without clear user awareness. Because the tool performs networked actions and may consume paid API quota or transmit user data to a third-party service, over-broad activation meaningfully raises security and privacy risk in agent environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation instructs use of an API key and multiple remote service commands but does not warn that prompts, images, and other user-provided content will be transmitted to an external provider, nor that API-backed operations may incur costs. In an agent setting, omission of these warnings can lead to inadvertent credential handling, privacy exposure, and unapproved outbound data transfer.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown command reference documents mmx auth login ... --api-key <key> but does not include any user warning about exposing secrets in shell history, process lists, or logs. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data or privacy, and credential entry on the command line is a clear sensitive case.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The mmx vision describe --image <path|url> command implies that user-provided images, including local files, may be transmitted for remote processing, but the documentation gives no warning about privacy-sensitive content. Under SQP-2 for markdown, user-facing descriptions should warn when behavior may affect user data or privacy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

This file presents all operational instructions in Chinese and does not state that the skill is China-specific or offer any language/locale choice. Under SQP-3, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The mmx search query command inherently sends user-entered query content over the network, yet the markdown contains no disclosure about external transmission of potentially sensitive text. This is a markdown-level omission affecting user privacy awareness under SQP-2.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.