Security audit

Music Craft — MiniMax

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed MiniMax music workflow that may upload audio, lyrics, and prompts for cloud generation, with no evidence of hidden exfiltration or destructive behavior.

Install this only if you are comfortable using a MiniMax API key and sending selected prompts, lyrics, reference audio, and generated-content inputs to MiniMax for cloud workflows. Use local files you are authorized to process, choose output folders deliberately, and do not enable --allow-remote-model-code unless you have reviewed and trust the exact model repository.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The consent section is internally inconsistent: it says both backends may transmit audio to MiniMax, while the surrounding text clearly states the ACE-Step path is fully local. This can mislead users about data handling and cause either uninformed consent or unnecessary avoidance of the safer local path when processing sensitive or licensed audio.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The documentation instructs operators to use a separate private skill to fetch copyrighted songs from external sources, expanding this skill’s effective capabilities beyond music generation into content acquisition. That creates a supply-chain and data-provenance risk: users may pull untrusted or unauthorized media into downstream processing without clear trust, licensing, or safety boundaries.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The orchestrator exposes an option that passes allow_remote_code through to model-loading logic, enabling execution of remotely supplied model code during audio analysis. In a local-analysis skill, this expands the trust boundary from local files to arbitrary upstream model repositories and creates a realistic remote code execution and supply-chain risk if a malicious or compromised model source is used.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: This is a real logic flaw: the code comments and later routing say URLs are not accepted, but blocker evaluation still uses the generic `references` field, where any detected URL can satisfy the source-reference requirement. An attacker or confused user can supply only a URL and avoid the intended 'missing source file' blocker path, producing inconsistent validation behavior and potentially causing downstream components to treat unsupported external references as acceptable input.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documentation encourages use of external models and transcription/classification tooling without prominently warning that first use may download large remote model artifacts and that some workflows may involve third-party services if users follow the API suggestion. In a music-processing skill, audio inputs may contain sensitive voice or copyrighted material, so lack of disclosure can lead to unintentional data exposure or policy violations.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The example instructs operators to fetch draft or lyric content from a URL and send it to the external MiniMax lyrics API without an explicit consent or disclosure step. This can cause users' unpublished text, copyrighted lyrics, or sensitive material embedded in drafts to be transmitted to a third party unexpectedly.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The workflow combines private memory-derived preferences with generated prompts sent to an external music service, but it does not require disclosure or consent for reuse of stored personal preference data. Even if the data is not highly sensitive, silently exporting personalized profile information to a third party creates a privacy risk and violates user expectations.

Natural-Language Policy Violations

Medium

Confidence: 80% confidence
Finding: Hard-coding `--language english` can cause unintended transmission or transformation of user content in a language they did not choose, which is a consent and integrity issue. In this mashup context, language affects lyrics generation and style transfer, so silently defaulting may mis-handle sensitive or copyrighted text.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: This guidance instructs the agent to create directories and write multiple files on the local filesystem, including a default path under the user's home directory, without an explicit consent checkpoint at the point of action. In an agent setting, that can lead to unintended filesystem modification, clutter, overwrite of existing project artifacts, or writing sensitive/generated content to locations the user did not explicitly approve.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The file explicitly states that generation runs on MiniMax's cloud and that some workflows call the MiniMax API, but it does not clearly warn the user that prompts, lyrics, and potentially audio-derived content may be transmitted to a third-party service. In a music-analysis/generation skill, users may supply copyrighted, private, or unreleased material, so omission of a clear privacy notice can lead to unintentional data disclosure and policy/compliance issues.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The CLI advertises a flag to allow packages that fetch model code from the network without a strong warning that this may execute untrusted code. In this skill context, which is presented as music tooling rather than a model-development environment, that makes accidental enabling more likely and materially raises supply-chain and remote code execution risk.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.