T09 · Insecure Skill Coding Practices
Error
- Location
scripts/minimax_music.py:21- Finding
API credential and user-content disclosure through an unrestricted endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
MiniMax Frontend Dev
Security checks for vulnerabilities and agentic risk
Overview
The skill is largely a disclosed frontend and media-generation helper, but its MiniMax scripts can send API keys and user prompts to an arbitrary environment-configured endpoint and fetch unvalidated media URLs.
Review this before installing if you will use MiniMax media generation. Only set MINIMAX_API_BASE to official MiniMax HTTPS endpoints, keep the API key narrowly scoped and revocable, avoid putting confidential text or lyrics into prompts, and be cautious with returned download URLs and unpinned package installation. The skill does not show evidence of intentional theft or persistence, but its current endpoint and download handling are too broad for a clean benign install.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/minimax_image.py:76- Finding
Unvalidated response-directed downloads permit SSRF and unbounded file retrieval
- Content
View full analysis
{path}") ``` The video client contains the same pattern: ```python download_url = data.get("file", {}).get("download_url", "") if not download_url: raise SystemExit(f"No download_url in response: {json.dumps(data, indent=2)}") print(f" Downloading from {download_url[:80]}...") video_resp = requests.get(download_url, timeout=300) video_resp.raise_for_status() os.makedirs(os.path.dirname(output_path) or ".", exist_ok=True) with open(output_path, "wb") as f: f.write(video_resp.content) ``` ### Technical Analysis The scripts trust URLs returned in API responses and issue unrestricted `GET` requests to them. They do not validate the URL scheme, hostname, resolved IP address, redirect chain, response content type, or response size. A malicious or compromised API endpoint can therefore make the client connect to loopback, private, link-local, or cloud metadata addresses. Because `requests` follows redirects by default, an apparently acceptable public URL could also redirect to an internal destination. This creates a server-side request forgery primitive from the machine running the Skill ...[truncated 1786 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
references/env-setup.md:8- Finding
Unpinned third-party package installation creates supply-chain exposure
- Content
View full analysis
- Remediation
View remediation
T03 · Remote Payload Retrieval and Execution
Warning
- Location
templates/viewer.html:23- Finding
Browser template retrieves and executes remote JavaScript without integrity verification
- Content
View full analysis
``` ### Technical Analysis The HTML template loads executable p5.js code from CDNJS at page-open time without a Subresource Integrity hash. It also does not establish a restrictive Content Security Policy. Although the URL includes a library version, the browser has no cryptographic assertion that the returned bytes match the version reviewed by the Skill author. If the CDN resource, account, delivery infrastructure, or network trust path is compromised, substituted JavaScript executes in the viewer's page context. This is a remote payload execution channel whose effective content can change independently of the audited Skill package. The template comments describe the output as a “self-contained artifact,” but it depends on CDNJS and Google Fonts. Opening it therefore produces third-party network requests that reveal visitor IP address, user-agent details, referrer behavior subject to browser policy, and timing metadata. ### Attack Path 1. An attacker compromises the CDN-hosted asset, its publishing path, or a trusted delivery component. 2. The user opens an interactive artifact created from `templates/viewer.html`. 3. The browser requests `p5.min.js` from CDNJS. 4. Because no integrity hash is present, the browser accepts any successfully delivered JavaScript. 5. The substituted payload executes with the privileges available to scripts in the viewer's origin. 6. It may read or modify page content, issue netw ...[truncated 768 chars]- Remediation
View remediation
``` 4. Do not use a placeholder hash; calculate and independently verify it against the exact reviewed asset. 5. Add a restrictive Content Security Policy that limits scripts, styles, fonts, images, and network connections to the minimum required destinations. 6. Set an appropriate `Referrer-Policy`. 7. Update the template documentation so “self-contained” is used only when every executable and font asset is actually included locally. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Findings (65)
Tainted flow: 'API_BASE' from os.getenv (line 23, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python if seed is not None: payload["seed"] = seed resp = requests.post( f"{API_BASE}/image_generation", headers=_headers(), json=payload,
Tainted flow: 'API_BASE' from os.getenv (line 24, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 96% confidence
- Finding
The request target is taken directly from the MINIMAX_API_BASE environment variable and used to send a Bearer token plus user-supplied prompt/lyrics to whatever host is configured. If an attacker can influence the environment, this becomes an SSRF/exfiltration sink that can leak credentials and content to an attacker-controlled endpoint; the frontend/media-generation context increases sensitivity because prompts and lyrics may contain proprietary or user data.
- Content
python if lyrics_optimizer: payload["lyrics_optimizer"] = True resp = requests.post( f"{API_BASE}/music_generation", headers={ "Authorization": f"Bearer {API_KEY}",
Tainted flow: 'API_BASE' from os.getenv (line 24, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 93% confidence
- Finding
The request destination is taken directly from the MINIMAX_API_BASE environment variable and the Authorization bearer token is sent to that endpoint. If an attacker or untrusted runtime controls the environment, they can redirect requests to an arbitrary server and exfiltrate the API key and user-provided text, making this an SSRF-style credential leakage issue rather than a harmless configuration choice.
- Content
python "output_format": "hex", } resp = requests.post( f"{API_BASE}/t2a_v2", headers={ "Authorization": f"Bearer {API_KEY}",
Tainted flow: 'API_BASE' from os.getenv (line 24, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python "prompt_optimizer": prompt_optimizer, } resp = requests.post( f"{API_BASE}/video_generation", headers=_headers(), json=payload,
Tainted flow: 'API_BASE' from os.getenv (line 24, credential/environment) → requests.get (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python """Poll task status until Success. Returns file_id.""" elapsed = 0 while elapsed < max_wait: resp = requests.get( f"{API_BASE}/query/video_generation", headers=_headers(), params={"task_id": task_id},
Tainted flow: 'API_BASE' from os.getenv (line 24, credential/environment) → requests.get (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python def download_video(file_id: str, output_path: str): """Retrieve download URL via file_id and save the video.""" resp = requests.get( f"{API_BASE}/files/retrieve", headers=_headers(), params={"file_id": file_id},
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description presents a broad frontend development and creative web production skill focused on premium UI design, motion, copywriting, and media generation in the context of building web pages. The supplied code does not implement frontend development, page generation, animations, copywriting, or visual art workflows. Instead, it is narrowly a synchronous text-to-speech client for the MiniMax API, taking text input, calling an external TTS endpoint with an API key, decoding returned hex audio, and writing audio files locally. While the description mentions generating media assets including audio/music, this code’s primary purpose is specifically TTS generation and file export, which is materially different from the declared primary skill of full-stack frontend/web experience creation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description presents a comprehensive frontend development and creative-production skill centered on building visually striking web pages and related assets. The supplied code does not implement frontend development or page-building behavior at all. Instead, it is a standalone command-line script for one specific backend task: generating a video from text via the MiniMax API, polling task status, and downloading the resulting file. While the description does mention generating media assets, that reference is much broader and embedded in a web-development skill; the actual code’s primary purpose is materially different and much narrower. It also performs undeclared external API access and local file download/storage using API keys. Therefore the description does not accurately represent the code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The supplied code does not implement a broad frontend-development or media-generation skill. Instead, it is a narrow JavaScript template for p5.js generative art sketches. It includes seeded randomness, p5 lifecycle scaffolding, utility helpers, parameter updates, and image export, but no page-building logic, no UI framework usage, no copywriting, no AI/media-generation integrations, and no cinematic web animation system. While generative art is one small subset of the declared description, the actual code’s primary purpose is materially narrower and different from the declared all-in-one frontend and creative production capability.
- Content
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
md ## 3.2 Workflow 1. **Parse:** type, quantity, style, spec, usage 2. **Craft prompt:** Be specific (composition, lighting, style). **NEVER** include text in image prompts. 3. **Execute:** Show prompt to user, **MUST confirm before generating**, then run script 4. **Save:** `<project>/public/assets/{images,videos,audio}/` as `{type}-{descriptor}-{timestamp}.{ext}` — **MUST save locally** 5. **Post-process:** Images → WebP, Videos → ffmpeg compress, Audio → normalize 6. **Deliver:** File path + code snippet + CSS suggestion
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill explicitly references environment variables, local file access, and external API-backed generation scripts, but it does not declare any tool scope or allowed-tools restrictions. In an agent environment, this creates unnecessary ambiguity about what capabilities the skill may exercise and increases the chance of overbroad execution, especially where network and filesystem actions are involved.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The instruction "ANTI-EMOJI POLICY: NEVER use emojis anywhere" imposes a communication-style restriction that functions as a language/locale policy without any user choice or documented justification. This can conflict with user preferences or accessibility/communication norms and is stated as a mandatory rule.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
macOS:
brew install ffmpeg
Ubuntu:
sudo apt install ffmpeg
text ## 3. Quick test
Indirect Prompt Extraction
Medium
- Category
- System Prompt Leakage
- Confidence
- 75% confidence
- Finding
Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.
- Content
md | 1002 | Rate limit | Wait and retry | | 1004 | Auth failed | Check API key | | 1008 | Insufficient balance | Top up account | | 1026 | Content flagged | Rephrase prompt/lyrics | | 2013 | Invalid parameters | Check prompt/lyrics length |
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
10 seconds, 1080P
python scripts/minimax_video.py "City skyline at sunset [Push in]" -o city.mp4 --duration 10 --resolution 1080P
Disable prompt auto-optimization
python scripts/minimax_video.py "Exact prompt I want used" -o out.mp4 --no-optimize
text
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
10 seconds, 1080P
python scripts/minimax_video.py "City skyline at sunset [Push in]" -o city.mp4 --duration 10 --resolution 1080P
Disable prompt auto-optimization
python scripts/minimax_video.py "Exact prompt I want used" -o out.mp4 --no-optimize
text
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
python # 10 seconds, 1080P python scripts/minimax_video.py "City skyline at sunset [Push in]" -o city.mp4 --duration 10 --resolution 1080P # Disable prompt auto-optimization python scripts/minimax_video.py "Exact prompt I want used" -o out.mp4 --no-optimize ```
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The document makes gender matching a mandatory, non-negotiable rule for voice selection, which can encode discriminatory behavior into downstream applications. In a frontend/content-generation skill, this guidance may cause systems to deny user preference, mis-handle nonbinary or ambiguous characters, and produce biased UX decisions at scale.
- Content
YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]
Medium
- Category
- YARA Match
- Confidence
- 65% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md ritated male voice | Drama, comedy | | `Spanish_AssertiveQueen` | Assertive Queen | Confident, commanding queen voice | Drama, fantasy | | `Spanish_CaringGirlfriend` | Caring Girlfriend | Nurturing, loving girlfriend voice | Romance, relationship | | `Spanish_PowerfulSoldier` | Powerful Soldier | Strong, brave soldier voice | Action, military | | `Spanish_PassionateWarrior` | Passionate Warrior | Fierce, dedicated warrior voice | Action, fantasy | | `Spanish_ChattyGirl` | Chatty Girl | Talkative, sociable girl voice | Comedy, social | | `Spanish_RomanticHusband` | Romantic Husband | Loving, romantic husband voice | Romance, family | | `Spanish_CompellingGirl` | CompellingGirl | Persuasive, magnetic girl voice | Marketing, entertainment | | `Spanish_PowerfulVeteran` | Powerful Veteran | Experienced, strong veteran voice | Military, drama | | `Spanish_SensibleManager` | Sensible Manager | Practical, reasonable manager voice | Business, guidance | | `Spanish_ThoughtfulLady` | Thoughtful L
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md brew install ffmpeg # Ubuntu sudo apt install ffmpeg # Verify ffmpeg -version
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python import requests API_KEY = os.getenv("MINIMAX_API_KEY") # China Mainland: https://api.minimaxi.com/v1 # Overseas: https://api.minimax.io/v1 API_BASE = os.getenv("MINIMAX_API_BASE") if not API_BASE:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python import requests API_KEY = os.getenv("MINIMAX_API_KEY") # China Mainland: https://api.minimaxi.com/v1 # Overseas: https://api.minimax.io/v1 API_BASE = os.getenv("MINIMAX_API_BASE") if not API_BASE:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python import requests API_KEY = os.getenv("MINIMAX_API_KEY") # China Mainland: https://api.minimaxi.com/v1 # Overseas: https://api.minimax.io/v1 API_BASE = os.getenv("MINIMAX_API_BASE") if not API_BASE:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python import requests API_KEY = os.getenv("MINIMAX_API_KEY") # China Mainland: https://api.minimaxi.com/v1 # Overseas: https://api.minimax.io/v1 API_BASE = os.getenv("MINIMAX_API_BASE") if not API_BASE:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python API_KEY = os.getenv("MINIMAX_API_KEY") # China Mainland: https://api.minimaxi.com/v1 # Overseas: https://api.minimax.io/v1 API_BASE = os.getenv("MINIMAX_API_BASE") if not API_BASE: raise SystemExit("ERROR: MINIMAX_API_BASE is not set.")