Music Craft — MiniMax

• Outcome: Pass
• Latest audit: Jul 30, 2026 · 1:11 PM UTC
• Version: 1.6.0

Overview

This MiniMax music skill openly uses local audio files, shell helpers, and MiniMax cloud APIs for music generation, with some caveats users should understand but no evidence of deceptive or malicious behavior.

Install only if you are comfortable giving the skill local audio paths, writing generated files/caches, and sending prompts, lyrics, and selected audio to MiniMax with your own API key. Avoid the optional remote-model-code flag and git-based installs unless you have reviewed them, and use local-only or no-advanced analysis when you do not want external model downloads.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (17)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

run_dir_path = Path(run_dir)
            run_dir_snapshot = _output_snapshot(list(run_dir_path.glob("*.mp3")))
            print(f"attempt {attempt}/{attempts}: {' '.join(cmd)}", file=sys.stderr)
            result = subprocess.run(cmd, text=True, capture_output=True, cwd=run_dir)
            stdout = result.stdout
            if stdout:
                print(stdout, end="")

• Confidence: 89% confidence
• Finding: This code executes an external binary and fully user-controlled command arguments via subprocess.run. Although it avoids shell injection by using a list, it still delegates powerful behavior to an attacker-influenced executable/CLI invocation (mmx_bin and command_args), which can read local files, write arbitrary output paths, and trigger networked generation depending on how this wrapper is exposed by the skill.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documentation describes capabilities that read environment variables, invoke shell tools, access the network, and read/write local files, but it does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: operators or a host platform may underestimate the skill's power and approve execution without understanding that it can upload local audio, write outputs, and run external binaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 86% confidence
• Finding: The skill advertises music generation features, but the documentation also includes broad local analysis, transcription, stem separation, embedding, and verification workflows that substantially expand data handling. That mismatch is risky because users may consent to generation while not realizing the skill can deeply inspect audio contents, extract lyrics and metadata, and persist multiple derived artifacts locally or send material to external services.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The consent section incorrectly states that both cover backends may transmit audio to MiniMax, while the surrounding documentation says the local ACE-Step path stays on the user's machine. This can mislead users about privacy and data handling, causing unnecessary consent friction or incorrect decisions about whether local processing avoids third-party disclosure.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The file states earlier that URLs are not accepted in v1.5.0+ and users must first fetch audio locally via a private skill, but later says the cover feature ID requires an audio URL or file. That inconsistency can cause operators or downstream agents to bypass the intended routing guardrails and submit remote URLs directly, undermining the documented trust boundary and potentially reintroducing unsafe or unsupported remote-fetch behavior.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The document repeatedly states the invariant that dry mode must never invoke subprocesses, but the composition helper computes `quota_cost = mmx_quota_snapshot() if check_quota else None` before checking `dry`. That means a caller using `dry=True, check_quota=True` still executes `mmx quota show`, violating the advertised safety property and potentially consuming resources or producing side effects during a supposed no-op preview.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This orchestrator advertises local audio analysis, but it exposes a flag that permits downstream model-loading code to fetch and execute remote model code via `allow_remote_code`. In ML tooling, enabling remote model code can lead to arbitrary code execution if an untrusted or compromised model repository is referenced, which breaks the local-only trust boundary and can expose the host running the skill.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The code can execute Hugging Face repository-provided Python via trust_remote_code=True when the --allow-remote-model-code flag is supplied. Even though consent is requested, this still enables arbitrary code execution from a remote model repository, which is especially concerning because the skill manifest describes MiniMax-native music generation and does not disclose this separate code-executing dependency path.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documented workflow fetches user-provided draft text from an arbitrary URL and forwards that content to the external MiniMax lyrics API, but it does not require an explicit user-facing disclosure or confirmation before transmitting potentially sensitive material off-platform. In a skill that may process private drafts, unpublished lyrics, or personal content, this creates a real privacy and data-handling risk.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The worked example hard-codes 'Spanish male vocal' for a French-song-to-reggaeton mashup without framing language and voice as user-controlled choices. This can cause the agent to override user intent or infer sensitive preference attributes, producing unwanted transformations and reducing meaningful consent around generated identity/language characteristics.

Missing User Warnings

Medium

• Confidence: 79% confidence
• Finding: Initializing a Hugging Face transformers pipeline with a named remote model can trigger implicit model download and related network access at runtime, even though the tool presents itself as local audio analysis. In an agent or sandboxed environment, this can leak operational metadata, violate offline expectations, or cause unreviewed third-party code/artifacts to be fetched without explicit user consent.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The call to Hugging Face transformers.pipeline with the CLAP model can implicitly download model artifacts or contact external services when the model is not already cached. In an agent skill, this creates an unannounced outbound network dependency and can leak execution metadata, break air-gapped expectations, or cause policy violations in environments that assume local-only processing of user-provided audio.

External Transmission

Medium

• Category: Data Exfiltration

Content

DRAFT=$(web_fetch(url="https://example.com/user-draft.txt", extractMode="text"))

# Step 2: Edit via MiniMax lyrics API
EDITED=$(curl -s -X POST https://api.minimax.io/v1/lyrics_generation \
  -H "Authorization: Bearer $MINIMAX_API_KEY" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --arg lyrics "$DRAFT" '{

• Confidence: 90% confidence
• Finding: The explicit reference to the MiniMax API endpoint confirms that workflow data leaves the local runtime boundary and is sent to a remote service. In this skill context, that is only safe when users understand that their fetched text will be shared externally; otherwise the documentation normalizes silent third-party transmission.

External Transmission

Medium

• Category: Data Exfiltration

Content

DRAFT=$(web_fetch(url="https://example.com/user-draft.txt", extractMode="text"))

# Step 2: Edit via MiniMax lyrics API
EDITED=$(curl -s -X POST https://api.minimax.io/v1/lyrics_generation \
  -H "Authorization: Bearer $MINIMAX_API_KEY" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --arg lyrics "$DRAFT" '{

• Confidence: 90% confidence
• Finding: The explicit reference to the MiniMax API endpoint confirms that workflow data leaves the local runtime boundary and is sent to a remote service. In this skill context, that is only safe when users understand that their fetched text will be shared externally; otherwise the documentation normalizes silent third-party transmission.

Unvalidated Output Injection

High

• Category: Output Handling

Content

except Exception as e:
            quota = {"error": str(e)}
    t0 = time.monotonic()
    proc = subprocess.run(argv, capture_output=True, text=True, timeout=600)
    return MMXReceipt(argv=argv, output_path=out_path,
                       returncode=proc.returncode,
                       elapsed_s=time.monotonic() - t0,

• Confidence: 77% confidence
• Finding: This orchestrator example builds `argv` from multiple externally supplied fields such as `prompt`, `lyrics_file`, `language`, `key`, and `out_path`, then executes `mmx` directly. While it avoids shell injection by using argument vectors, it still passes unvalidated parameters to a powerful external tool, creating a tool-parameter abuse surface that could overwrite arbitrary files, read unintended local inputs, or trigger unsafe downstream behavior depending on how `mmx` handles those flags.

Unvalidated Output Injection

High

• Category: Output Handling

Content

run_dir_path = Path(run_dir)
            run_dir_snapshot = _output_snapshot(list(run_dir_path.glob("*.mp3")))
            print(f"attempt {attempt}/{attempts}: {' '.join(cmd)}", file=sys.stderr)
            result = subprocess.run(cmd, text=True, capture_output=True, cwd=run_dir)
            stdout = result.stdout
            if stdout:
                print(stdout, end="")

• Confidence: 82% confidence
• Finding: The wrapper accepts external command output from mmx and stdout is printed directly, while stderr is also forwarded. In a CLI-agent context this can enable terminal control-sequence injection or misleading log/output content from an untrusted downstream tool, and more broadly the wrapper forwards unvalidated user input into a powerful external command.

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High

• Category: YARA Match

Content

pip install git+https://github.com/marl/crepe.git
```

### What it gives you

- Frame-level pitch detection (every 10ms) with high accuracy
- Confidence per frame

• Confidence: 97% confidence
• Finding: The documentation recommends installing code directly from a remote Git repository using pip install git+https://..., which executes unpinned third-party packaging/build logic at install time. In an agent-skill context, this is dangerous because it creates a supply-chain execution path: a compromised repo, force-pushed tag, or dependency confusion event could lead to arbitrary code execution on the host.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.