T01 · Skill Instruction Hijacking
Error
- Location
README.md:23- Finding
Persistent Cross-Workspace Agent Instruction Override
- Content
View full analysis
- Remediation
View remediation
Security audit
Minimax Tts Cn
Security checks for vulnerabilities and agentic risk
Overview
This is a real MiniMax text-to-speech skill, but it asks users to make broad persistent workspace instruction changes and stores API tokens in a weak local format.
Install only if you are comfortable sending text to MiniMax and storing one shared MiniMax token locally. Avoid applying the README's global TOOLS.md override across workspaces, and do not use --output paths that could overwrite important files.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
server/index.py:146- Finding
Shared MiniMax API Token Stored in a Plaintext File
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
server/index.py:57- Finding
Arbitrary Output Path Allows Existing Files or Symlink Targets to Be Overwritten
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python import urllib.error SCRIPT_DIR = os.path.dirname(os.path.abspath(__file__)) ENV_FILE = os.path.join(SCRIPT_DIR, '.env') VOICES = { 'female-tianmei-jingpin': '甜美女声 ★精品',
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The file is labeled as a Chinese edition and all user-facing instructions and invocation wording are fixed in Chinese, with no opt-in language choice described. Under the stated policy, forcing a specific language without user choice can be a natural-language policy violation unless clearly justified as region-specific.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documented trigger phrases are broad, natural-language terms such as “TTS”, “生成语音”, and “转MP3”, which can easily appear in ordinary conversation and cause unintended invocation. In an agent setting, accidental activation can lead to unexpected prompting for secrets, unintended API usage, or unintended generation/transmission of audio files.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Presenting “在聊天里说‘文字转语音’” as sufficient to start the flow makes invocation ambiguous and too permissive for a chat environment. This increases the chance that discussion about TTS, quoted text, or third-party content triggers the workflow unintentionally, which is especially risky because the flow includes token handling and file generation.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill invokes Python commands and, by its own documentation, reads environment data, writes files, stores tokens locally, and makes outbound network requests, yet it declares no explicit tool/permission scope. This increases the blast radius because the runtime may grant broader capabilities than users or reviewers expect, making misuse or accidental overreach harder to constrain.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs users to submit their MiniMax API token and stores it locally in
server/.envwithout an explicit warning about persistence, access scope, retention, or who can read that file. Secret collection and local storage without clear consent and protection guidance can expose credentials to other processes, users, backups, logs, or future sessions.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The skill sends user-provided text and an API token to an external third-party service (
api.minimaxi.com) to generate speech. External transmission is expected for a cloud TTS skill, but it still creates real privacy and data-handling risk because potentially sensitive user content leaves the local environment and is processed by another provider.- Content
md ## 工作原理 1. `voices` / `save-token` 管理本地 Token（存于 `server/.env`） 2. `tts` 调用 `https://api.minimaxi.com/v1/t2a_v2` 3. API 返回 hex 编码音频，解码后写入 MP3 文件 4. 将文件路径打印到 stdout，AI 解析路径后调用 `message` 工具（`media=<绝对路径>`）发送给用户
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python try: req = urllib.request.Request( "https://api.minimaxi.com/v1/t2a_v2", data=json.dumps(payload).encode(), headers={ "Authorization": f"Bearer {token}",
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The command stores the MiniMax API token in a plaintext .env file in the skill directory without warning the user about persistence or enforcing restrictive file permissions. On a multi-user host, shared workspace, or packaged skill environment, other local users/processes or accidental uploads could expose the credential and enable unauthorized API usage.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The skill description and prescribed trigger phrases are entirely in Chinese and instruct a fixed interaction flow in that language, with no indication that users may choose another language. This can violate language/locale policy when no user opt-in or documented justification is provided.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
L103-L112 明确声明发送文件的唯一正确方式是在回复文本中使用
MEDIA:前缀，并且禁止使用message工具等其他方式。但 L168 又写成“AI 解析路径后调用message工具（media=<绝对路径>）发送给用户”，与前述操作约束直接冲突，属于文档意图与实际指令的自相矛盾。- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The module docstring and subsequent user-facing CLI messages are presented in Chinese only, with no option to select another language or locale. This is a natural-language policy concern because the skill imposes a specific language on all users without opt-in or documented justification.
- Content