Security checks across malware telemetry and agentic risk
The skill is broadly a real MiniMax music workflow, but it needs review because it can automatically install packages and run remote model code beyond normal media generation.
Review before installing. Use this only if you are comfortable sending music prompts, lyrics, URLs, images, and audio to MiniMax or related services. Run it in a virtual environment or sandbox, preinstall dependencies yourself, avoid the auto-install YouTube path, keep MINIMAX_API_KEY scoped and rotated if exposed, and choose output paths carefully because some helpers can overwrite files.
def install_yt_dlp():
"""Install yt-dlp via pip."""
print("Installing yt-dlp...", file=sys.stderr)
subprocess.run(
[sys.executable, '-m', 'pip', 'install', 'yt-dlp', '--quiet', '--break-system-packages'],
check=True
)captions = []
for kf_path in keyframes:
try:
proc = subprocess.run(
['mmx', 'vision', 'describe', kf_path],
capture_output=True, text=True, timeout=60,
)VirusTotal findings are pending for this skill version.