Security audit

minimax-tts

Security checks for vulnerabilities and agentic risk

Overview

This MiniMax TTS skill mostly does what it claims, but it also includes an undocumented image-generation command and can send the user's API key and content to any endpoint named in an environment variable.

Review before installing. Use only if you trust the publisher and intend to call MiniMax with your API key. Do not set MINIMAX_BASE_URL unless you fully control and trust that endpoint, avoid submitting sensitive text, and be aware the package contains an undocumented image-generation/download command in addition to TTS.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/minimax_media.py:17
Finding: Configurable API Endpoint Can Receive the API Key and User Content
Content: View full analysis
dict: """使用 MiniMax image-01 生成圖片""" url = f"{BASE_URL}/v1/image_generation" headers = { 'Authorization': f'Bearer {API_KEY}', 'Content-Type': 'application/json' } payload = { 'model': 'image-01', 'prompt': prompt } resp = requests.post(url, headers=headers, json=payload, timeout=60) ``` The TTS operation forwards the same credential and user content: ```python def text_to_speech(text: str, voice_id: str = 'female-tianmei', speed: float = 1.0, output_path: str = None) -> dict: """使用 MiniMax speech-2.8-hd 生成語音""" url = f"{BASE_URL}/v1/t2a_v2" headers = { 'Authorization': f'Bearer {API_KEY}', 'Content-Type': 'application/json' } payload = { 'model': 'speech-2.8-hd', 'text': text, 'stream': False, 'output_format': 'hex', 'voice_setting': { 'voice_id': voice_id, 'speed': speed, 'vol': 1, 'pitch': 0 }, 'language_boost': 'auto' } resp = requests.post(url, headers=headers, json=payload, timeout=60) ``` ### Technical Analysis Sending the API key and input text to the official MiniMax service is necessary for the declared cloud-based text-to-speech function. The default endpoint, `https://api.minimax.io`, is consistent with the documentation. However, `MINIMAX_BASE_URL` can replace that endpoint with an arbitrary URL. The code performs no scheme validation, host ...[truncated 1893 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/minimax_media.py:49
Finding: Race-Prone Temporary Output File Creation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/minimax_media.py:20
Finding: Undocumented Image Generation Downloads an Unrestricted API-Supplied URL
Content: View full analysis
dict: """使用 MiniMax image-01 生成圖片""" url = f"{BASE_URL}/v1/image_generation" headers = { 'Authorization': f'Bearer {API_KEY}', 'Content-Type': 'application/json' } payload = { 'model': 'image-01', 'prompt': prompt } resp = requests.post(url, headers=headers, json=payload, timeout=60) if resp.status_code != 200: return {"error": f"API error {resp.status_code}: {resp.text[:200]}"} data = resp.json() image_urls = data.get('data', {}).get('image_urls', []) if not image_urls: return {"error": "No image URL returned"} # 下載圖片 img_resp = requests.get(image_urls[0], timeout=60) if img_resp.status_code != 200: return {"error": f"Failed to download image: {img_resp.status_code}"} if output_path is None: output_path = tempfile.mktemp(suffix='.png') with open(output_path, 'wb') as f: f.write(img_resp.content) return { "image_path": output_path, "url": image_urls[0], "size_bytes": len(img_resp.content) } ``` The undocumented operation is exposed through the command dispatcher: ```python if cmd == 'image': if len(sys.argv) < 3: print(json.dumps({"error": "Usage: minimax_media.py image "})) sys.exit(1) prompt = ' '.join(sys.argv[2:]) result = generate_image(prompt) print(json.dumps(result, ensure_ascii=False, indent=2)) ``` ### Technical Analysis The Skill metadata and documentation declare a text-to-speech Skill, but the implementation also accepts an `image` command. This expands the Skill’s network behavior beyond ...[truncated 2231 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tainted flow: 'url' from os.environ.get (line 61, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: The request destination is derived from MINIMAX_BASE_URL, an environment variable, and the same request includes the Authorization bearer token. If an attacker can influence the environment, they can redirect traffic and exfiltrate the API key and all submitted prompt data to an attacker-controlled endpoint. In a skill/integration context, this is more dangerous because secrets are commonly injected via environment and operators may assume the endpoint is fixed to the vendor.
Content: Scanner excerpt · scripts/minimax_media.py (reported line 32)May include surrounding context.
python
'model': 'image-01', 'prompt': prompt } resp = requests.post(url, headers=headers, json=payload, timeout=60) if resp.status_code != 200: return {"error": f"API error {resp.status_code}: {resp.text[:200]}"}

Tainted flow: 'url' from os.environ.get (line 61, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: The TTS request also uses a base URL sourced from the environment while attaching the bearer token and user text. A manipulated environment can redirect these authenticated requests to an attacker-controlled server, exposing credentials and sensitive user-provided text. Because this function is the declared core capability of the skill, exploitation would affect the primary data path and all users.
Content: Scanner excerpt · scripts/minimax_media.py (reported line 79)May include surrounding context.
python
}, 'language_boost': 'auto' } resp = requests.post(url, headers=headers, json=payload, timeout=60) if resp.status_code != 200: return {"error": f"HTTP error {resp.status_code}: {resp.text[:200]}"}

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is presented as a text-to-speech tool, but the detected behavior reportedly includes image generation and downloading external media. That mismatch is dangerous because users may authorize or invoke the skill under false assumptions, enabling broader networked actions and data flows than the description suggests.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file implements image generation in addition to the declared TTS purpose, creating capability drift from the skill manifest. Undeclared capabilities increase security risk because they expand data flows and network actions users and reviewers may not expect, reducing informed consent and complicating policy review. In this context, the mismatch is meaningful because the extra feature performs external API calls and downloads files.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises executable behavior that uses environment variables and network access, but it does not declare any tool scope such as permissions or allowed-tools. This weakens reviewability and containment because callers cannot clearly see or restrict the skill’s operational capabilities before installation or execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation omits a warning that user-provided text is sent to an external MiniMax service. This creates a privacy and data-handling risk because users may supply sensitive content without realizing it leaves the local environment and is processed by a third party.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The module docstring explicitly advertises image generation plus TTS, contradicting the declared skill intent. This inconsistency can mislead users and reviewers about what data leaves the system and what actions the code may perform. The impact is lower than direct code flaws, but in skill ecosystems scope deception materially weakens trust and review quality.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The image-generation function is not justified by the stated TTS-only purpose and adds an unnecessary attack surface. Even if not malicious, unnecessary functionality increases exposure to misuse, hidden network activity, and future maintenance errors. In a least-privilege review, this is a real security concern rather than a mere documentation issue.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/minimax_media.py (reported line 32)May include surrounding context.
python
'model': 'image-01', 'prompt': prompt } resp = requests.post(url, headers=headers, json=payload, timeout=60) if resp.status_code != 200: return {"error": f"API error {resp.status_code}: {resp.text[:200]}"}

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/minimax_media.py (reported line 79)May include surrounding context.
python
'model': 'image-01', 'prompt': prompt } resp = requests.post(url, headers=headers, json=payload, timeout=60) if resp.status_code != 200: return {"error": f"API error {resp.status_code}: {resp.text[:200]}"}

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code sends user-provided image prompts to an external API via HTTP, but there is no confirmation prompt or user-facing disclosure at the call site that the content will be transmitted off-system. The module docstring describes usage but does not warn that prompts are sent to MiniMax servers, so users may not realize their input leaves the local environment.
Content: No source excerpt is available for this finding.

Tainted flow: 'image_urls' from requests.post (line 37, network input) → requests.get (network output)

Medium

Category: Data Flow
Confidence: 80% confidence
Finding: The code fetches image_urls[0] returned by the upstream API without validating the scheme, host, or IP range. If the upstream service is compromised, misconfigured, or a malicious base URL is used, this creates a server-side request forgery style primitive that can trigger requests to internal services or unexpected external hosts. The skill context increases risk because this is hidden secondary network access not obvious from a TTS-focused skill.
Content: Scanner excerpt · scripts/minimax_media.py (reported line 42)May include surrounding context.
python
return {"error": "No image URL returned"} # 下載圖片 img_resp = requests.get(image_urls[0], timeout=60) if img_resp.status_code != 200: return {"error": f"Failed to download image: {img_resp.status_code}"}

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The TTS path transmits arbitrary user text to MiniMax over the network, but the script provides no explicit warning that potentially sensitive text will be sent to a third-party service. The current description only states usage and model purpose, which is insufficient disclosure for privacy-impacting behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The natural-language documentation and help strings are presented only in Chinese, which may impose a language preference without user opt-in. Under the language/locale policy, locale-specific wording should either offer a language choice or clearly justify that the tool is intended for a Chinese-speaking context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The script reads MINIMAX_API_KEY from the environment to authenticate external requests, but there is no visible notice in output, comments, or CLI help that the skill uses credentials from the user's environment. For a safety audit, credential use should be disclosed so users understand the script depends on and transmits authenticated requests with their configured account.
Content: No source excerpt is available for this finding.