ClawHub
Back to skill

Security audit

Music Craft — MiniMax

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent MiniMax music-generation skill with disclosed cloud upload, local audio-analysis helpers, and user-controlled optional risks.

Install only if you are comfortable using your own MiniMax key and sending chosen prompts, lyrics, and local audio files to MiniMax. Do not upload private or copyrighted material unless you have the rights. Avoid optional unpinned installs and do not use --allow-remote-model-code unless you have reviewed and preferably pinned the exact model revision.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
references/advanced-audio-analysis.md:453
Finding

Installation of a Mutable Git Dependency Without Version or Integrity Pinning

Content
View full analysis

Vulnerability Details

File Location: references/advanced-audio-analysis.md:453-455
Vulnerability Type: Mutable and unverified third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash
pip install crepe
# Or for the latest version:
pip install git+https://github.com/marl/crepe.git

Technical Analysis

The documentation recommends installing Python code directly from the current state of a GitHub repository. The command does not specify a reviewed commit hash, release tag, package hash, or integrity constraint.

Consequently, the effective code installed by this command can change after the Skill has been audited. If the repository, its default branch, a maintainer account, or an upstream dependency is compromised, a later operator could install attacker-controlled code. Python package installation can execute build backend and installation logic, while subsequent imports execute the installed package with the privileges of the invoking user.

This dependency is optional and relevant to advanced pitch analysis, but fetching mutable Git HEAD exceeds the minimum supply-chain risk necessary to provide that feature. A fixed, reviewed artifact would provide the same functionality with a smaller trust boundary.

Attack Path

  1. An operator follows the documented “latest version” installation command.
  2. pip clones the repository’s current default branch rather than a reviewed immutable revision.
  3. An attacker who has compromised the repository, maintainer account, or branch introduces malicious build or runtime code.
  4. The malicious code executes during package installation or when the analysis workflow imports crepe.
  5. The code runs with the operator’s local privileges and can access files, environment variables, network resources, and credentials available to that process.

Impact Assessment

Successful exploitation can provide arbitrary Python code execution u ...[truncated 482 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the mutable Git HEAD installation recommendation.
  2. Prefer a reviewed, fixed package release with an exact version:
    bash
    python3 -m pip install 'crepe==<reviewed-version>'
  3. If installation from Git is necessary, pin an immutable reviewed commit:
    bash
    python3 -m pip install \
  'crepe @ git+https://github.com/marl/crepe.git@<full-reviewed-commit-sha>'
  4. Generate a lock file containing hashes for the complete dependency graph and require hash verification during installation.
  5. Record the reviewed repository revision and dependency license in the project documentation.
  6. Install optional analysis dependencies in an isolated virtual environment or container without unrelated credentials.
  7. Preserve the existing requirement that dependencies must not be installed without explicit user consent, but do not treat consent as a substitute for provenance and integrity controls.

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/compute_audio_embedding.py:116
Finding

Opt-In Execution of Unpinned Hugging Face Repository Code

Content
View full analysis

Vulnerability Details

File Location: scripts/compute_audio_embedding.py:116-127
Vulnerability Type: Remote model repository code retrieval and execution
Risk Level: High when enabled

Vulnerable Code

python
def _load_mert_model(model_name='m-a-p/MERT-v1-330M', device='cpu', allow_remote_code=False):
    global _MERT_MODEL
    if _MERT_MODEL is None:
        if not HAS_TRANSFORMERS:
            raise RuntimeError("transformers required — pip install 'transformers==4.47.1'")
        if not HAS_TORCH:
            raise RuntimeError("torch required")
        if not allow_remote_code:
            raise RuntimeError(
                "MERT loading requires Hugging Face remote model code. Re-run with "
                "--allow-remote-model-code only after reviewing the model source and accepting that risk."
            )
        _MERT_MODEL = AutoModel.from_pretrained(model_name, trust_remote_code=allow_remote_code)
        _MERT_MODEL.to(device)
        _MERT_MODEL.eval()
    return _MERT_MODEL

Technical Analysis

When --allow-remote-model-code is enabled, the script passes trust_remote_code=True to AutoModel.from_pretrained. This allows Python implementation files supplied by the remote model repository to be downloaded, imported, and executed locally.

No immutable Hugging Face revision is supplied. The effective executable payload can therefore change after review if the referenced repository or revision resolution changes. The function also accepts model_name programmatically, expanding the potential trust boundary beyond the documented default model.

The implementation is secure by default: remote code is disabled unless the operator explicitly supplies the consent flag, and the error message accurately discloses the risk. These safeguards reduce accidental exploitation but do not protect an approving operator from a repository compromise or an inadequately reviewed re ...[truncated 1576 chars]

Remediation
View remediation

Remediation Suggestions

  1. Prefer a model architecture supported natively by a pinned Transformers release so that trust_remote_code=False can remain enforced.
  2. If custom repository code is unavoidable, pin an immutable reviewed model revision:
    python
    AutoModel.from_pretrained(
    model_name,
    revision="<full-reviewed-commit-sha>",
    trust_remote_code=True,
)
  3. Restrict model_name to an explicit allowlist of reviewed repository and revision pairs.
  4. Verify downloaded files against stored hashes before loading them.
  5. Run remote model code in a sandboxed subprocess or container with:
    • No MiniMax or unrelated API credentials.
    • Read-only access to only the required audio input.
    • A dedicated cache directory.
    • Restricted outbound network access.
    • Resource limits and no host-level device access unless required.
  6. Separate model download and execution. Download the fixed revision for manual or automated review before allowing execution.
  7. Retain the current explicit opt-in flag and warning, but state the exact repository revision being approved rather than requesting approval for a mutable model name.
  8. Pin the associated transformers, torch, and model artifact dependencies in a hash-verified lock file.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (119)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description promises a music-generation and transformation skill with multiple MiniMax-specific creative capabilities and CLI controls. The actual code chunk does none of that. It is a utility module for caching analysis outputs to JSON files based on file metadata and a versioned hash key. While caching could be a supporting component in a larger system, this chunk’s primary behavior is unrelated to the declared end-user functionality, and none of the advertised music features are implemented here. Therefore, this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description emphasizes generative music functionality and MiniMax Music 2.6 integration for creating covers, style transfers, mashups, lyrics, and prompt/CLI-driven control. The actual code chunk does none of that. It is a helper library for analyzing existing audio signals and estimating musical attributes. While key, BPM/tempo feel, and structure estimation could support a broader music workflow, this chunk’s primary behavior is analysis, not generation, and it does not show the advertised MiniMax-native or mmx CLI capabilities. Therefore the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description centers on a generative music skill using MiniMax Music 2.6 features, including style transfer, mashup creation, lyrics generation/editing, and explicit generation controls. The supplied code does not generate music or lyrics and does not call MiniMax or an mmx CLI. Instead, it analyzes existing local audio files, optionally transcribes lyrics with Whisper, computes vocal emotion and other audio features, and assesses two-song compatibility for mashups. While there is some thematic overlap with mashups and emotion, the actual code is a preprocessing/analysis pipeline rather than a MiniMax-native music generation skill. This is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description emphasizes a music generation skill built around MiniMax Music 2.6 with advanced generative and editing capabilities plus CLI controls. The actual code does not generate, transform, edit, or mash up music, and it does not interface with MiniMax, OpenClaw mmx controls, lyrics systems, or prompt engineering. Its primary purpose is analytic: inspect one audio file and report extracted features. While some outputs like BPM, key, mood, and sections could support a larger music-generation workflow, this chunk by itself materially differs from the declared purpose and lacks the core advertised capabilities.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

The declared description presents a full music-generation and transformation skill integrated with MiniMax/OpenClaw, including lyric features and CLI controls. The supplied code chunk instead performs offline analysis of one or two audio files and produces JSON metadata and mashup planning suggestions. While mashup preparation and style-related recommendation are adjacent to the declared domain, the primary behavior is materially different: analysis rather than generation. It also introduces undeclared capabilities such as audio feature extraction and optional CLAP-based classification, while lacking the headline claimed capabilities (MiniMax generation, style transfer, lyrics, and mmx controls).

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description presents a music-generation skill extending MiniMax Music 2.6 capabilities, including cover/style transfer, mashups, lyric generation, and mmx CLI controls. The supplied code does none of those things. Instead, it analyzes an input audio file for vocal emotion dynamics and related acoustic/music features, then emits JSON and music-generation hints. While those hints could support a broader music workflow, this script’s actual primary function is analysis, not MiniMax-native generation or CLI control. Therefore the description does not accurately represent the supplied code chunk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The description claims a full-featured MiniMax/OpenClaw music generation skill with multiple advanced capabilities, but the provided code only automates sequential cover-generation runs from prompts against a single audio file. It does not implement style-transfer controls beyond passing prompt text to music cover, does not support two-song mashups, lyrics generation/editing, or explicit musical controls like BPM/key/structure/avoid lists. The code’s real purpose is a wrapper/orchestrator for batch cover jobs with output verification, not the broader feature set described. No concerning undeclared side capabilities appear beyond normal subprocess/env/file handling for this workflow, but the declared functionality materially overstates what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description focuses on music creation and editing features built on MiniMax Music 2.6, such as melody-preserving style transfer, mashups, lyrics generation, and musical control flags. The actual code does none of that. Instead, it queries the mmx CLI for quota information, parses JSON, prints quota summaries, and optionally aborts when available headroom is insufficient for a requested budget. This is a materially different primary purpose and an undeclared capability. While both reference MiniMax/mmx, the code chunk is operational tooling for quota monitoring rather than any music-generation functionality.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description presents a feature-rich music generation/manipulation skill built on MiniMax Music 2.6. The actual code chunk does not implement any of those user-facing music capabilities; instead, its primary purpose is environment/setup checking. While such a script could be a supporting utility within a larger music skill, this specific chunk’s behavior is materially different from the declared purpose and focuses on prerequisite validation, local PATH inspection, subprocess version probing, and environment variable checks. That makes the description inaccurate for the supplied code chunk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

There is a clear description-behavior mismatch. The declared purpose centers on generative music features using MiniMax Music 2.6—cover/style transfer, mashups, lyric generation/editing, emotional prompt engineering, and per-flag music-control CLI options. The actual code does none of that. It loads an audio classification transformer, reads an audio file, resamples/chunks it, predicts AudioSet labels, and outputs ranked tags. While this may be music-related, its primary purpose is analysis/tagging, not generation or control of music creation. It also performs undeclared network/model-fetch behavior and local cache I/O, which are inconsistent with the declared permissions/capabilities. Therefore this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description centers on generative and editing capabilities built on MiniMax Music 2.6 and OpenClaw integration. The supplied code does something materially different: it loads audio, resamples it, runs a Hugging Face MERT model to produce embeddings, caches JSON outputs, and optionally compares embeddings between two songs. This is an analysis/feature-extraction tool for similarity search or downstream classification, not a generation or transformation tool. While it is music-related, its primary purpose is substantially different from the declared one, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

This code chunk’s primary purpose is materially different from the declared description. The description promises MiniMax Music 2.6 generation features for OpenClaw—cover preservation, style transfer, mashups, lyric generation/editing, emotion-driven prompting, and CLI controls for music-generation parameters. The actual script only transcribes existing audio into lyrics using Whisper and adds structure tags/warnings. While lyric extraction could be a supporting preprocessing step in a broader music workflow, none of the headline declared capabilities are implemented in this code chunk, and the code instead performs an undeclared transcription capability. Therefore this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

This is a strong description-behavior mismatch. The declared purpose emphasizes generative music features tied to MiniMax/OpenClaw workflows, but the supplied code chunk performs audio transcription and music-theory analysis. Its primary function is extracting symbolic note information from an existing audio file, estimating key/mode, and optionally saving MIDI/JSON outputs. Those behaviors are materially different from the advertised generation, style transfer, mashup, lyrics, and prompt-engineering capabilities. While melody extraction could be a supporting component in a larger music system, this chunk by itself does not implement the declared core features and instead exposes a distinct undeclared capability: polyphonic audio-to-MIDI transcription.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description centers on generative music features and MiniMax-specific controls, but the supplied code only implements stem extraction/source separation with Demucs. Its purpose is preprocessing audio into vocals/drums/bass/other stems, likely for downstream analysis, not generating, editing, or transforming music in the ways described. This is a material purpose mismatch, not merely an implementation detail.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description promises a feature-rich MiniMax music generation/editing skill with multiple AI-driven capabilities and CLI controls. The supplied code chunk does not implement any of those behaviors. It only wraps ffmpeg to apply loudness normalization and set the sample rate, plus basic overwrite handling. While audio finalization could be a supporting utility in a larger music workflow, this chunk’s actual purpose is materially different from the declared primary purpose and lacks the advertised capabilities.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The description markets end-user music-generation capabilities such as cover/style transfer, mashups, lyric generation/editing, emotion-driven prompting, and fine-grained music parameter control. However, the supplied code does not implement those creative features. Instead, it is an operational wrapper around an existing mmx CLI: it retries transient failures, adds a default timeout, resolves file paths, runs commands in a temp directory, preserves output files, and validates/recover outputs after abnormal exits. While this supports music generation workflows, its primary purpose is reliability/execution management rather than providing the declared MiniMax Music feature set. Therefore the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared description promises a broad MiniMax music feature extension with multiple user-facing capabilities: melody-preserving cover/style transfer, mashups, lyric generation/editing, prompt engineering by emotion, and detailed CLI control over musical attributes. The supplied code does not implement that broad functionality. Instead, it only plans or runs an experimental workflow that swaps one stem in a four-stem mix. It reads stem paths from JSON, optionally invokes another script to generate a cover for a single stem when explicitly allowed, and then mixes stems with ffmpeg amix. There is no evidence of lyrics features, mashup of two songs, emotion-specific prompting logic, BPM/key/structure/avoid-list controls, or a larger OpenClaw integration layer. While the code does touch MiniMax cover generation in a limited way, its actual primary purpose is materially narrower and different from the declared description.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared description presents a full-featured MiniMax music-generation skill with advanced generation/editing capabilities. The supplied code chunk does not implement any of those core behaviors. Instead, it reads a lyrics file, checks whether bracketed section tags are from an allowed set, estimates duration from syllables and BPM, and emits JSON warnings/status. While lyric linting could be a supporting utility within a music-generation system, this chunk’s actual purpose is materially different from the declared primary purpose and omits the headline capabilities entirely. Therefore this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The description presents an end-user music generation skill with MiniMax Music 2.6 features. However, this code chunk only inspects requests and emits structured diagnostics for routing and quality control. It detects genres, moods, language, duration, lyrics source, vocal mode, references, source type, conflicts between prompt text and flags, lyrics tag validity, and blockers that force clarification. It also explicitly rejects URL sources in some cases and recommends alternative workflow steps. These are support/validation behaviors, not the declared core capability of generating covers, mashups, style transfers, or lyrics. Because the primary purpose of the code is materially different from the declared purpose, this is a clear mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description promises a feature-rich MiniMax-based music generation and transformation skill. The supplied code does not perform any of those functions. Instead, it analyzes an existing stems.json artifact from Demucs stem extraction, checks file existence and sizes, optionally uses ffprobe to get durations, and produces a heuristic report about dominant/quiet stems and next-step recommendations. This is an audio-analysis helper script, not a MiniMax-native music generation or editing tool. Therefore the description does not accurately represent the code’s actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

There is a clear description-behavior mismatch. The declared purpose describes a feature-rich music generation and transformation skill built around MiniMax, while the actual code only performs beat and downbeat tracking on an input audio file using a third-party inference model. Its primary purpose is analytical audio feature extraction, not generative music creation or lyric manipulation. The local cache and CLI flags are normal implementation details, but the main capability is materially different from the declared description.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description presents a music generation feature set centered on MiniMax Music 2.6 capabilities such as style transfer, mashups, lyric generation/editing, and prompt/CLI controls for composition parameters. The supplied code does none of that. Instead, it is a validation script for generated audio artifacts: it checks file existence, size thresholds, MP3 signatures/format, and optional duration ranges using ffprobe. This is a materially different primary purpose from music generation or transformation. While such validation could be a supporting utility in a broader music pipeline, the declared purpose does not mention output verification or QA tooling, and the code chunk itself does not implement any of the advertised generation features.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description centers on generating and controlling music with MiniMax Music 2.6 features. The actual code does not generate music, call MiniMax, manage BPM/key/structure settings, perform mashups, or create/edit lyrics. Its primary purpose is post-generation QA: compare expected lyrics to a transcript and report overlap. That is materially different from the declared purpose, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation contains contradictory safety guidance: it tells operators not to mutate existing audio files, then later authorizes an experimental stem-based path for changing one instrument. Conflicting instructions in an agent skill are dangerous because they erode operator trust boundaries and can lead to destructive or unexpected modification of user-provided media, especially when combined with file-write and shell capabilities.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 286)May include surrounding context.

md
| MiniMax-specific error handling | This skill, [`references/error-handling.md`](references/error-handling.md) |

Static analysis

No suspicious patterns detected.