Minimax-Multimodal-Toolkit

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:52 AM UTC
• Version: 1.0.2

Overview

The skill is a coherent MiniMax CLI guide, but it needs review because it encourages risky API-key handling and an unpinned global npm install.

Install only if you trust the mmx-cli npm package and are comfortable granting it MiniMax account/API access. Avoid putting real API keys directly in shell commands, prefer environment or secret-manager workflows where supported, verify the package/version before global installation, and be cautious with --yes because it can skip confirmation before quota-consuming operations.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Global npm Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:13
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable code:

bash

# Install
npm install -g mmx-cli

Technical Analysis

The Skill instructs users or agents to install mmx-cli globally without pinning a reviewed version, validating package integrity, or identifying a trusted registry and publisher. As a result, the code installed when this instruction is followed may differ from the version assessed during the Skill audit.

npm packages may execute lifecycle scripts during installation. The global installation scope increases the package's availability and influence beyond a single project. Although the documentation does not itself retrieve or execute a remote script directly, following this command delegates code selection and installation to the current npm registry and its dependency resolution process.

Attack Path

1. An attacker compromises the mmx-cli package, one of its dependencies, the publisher account, or the registry configuration used by the victim.
2. The attacker publishes a malicious version or causes the package name to resolve to attacker-controlled content.
3. A user or agent follows the Skill prerequisite and runs npm install -g mmx-cli.
4. npm downloads the unresolved latest version and may execute its lifecycle scripts.
5. Malicious code runs with the permissions of the account performing the installation and remains available through the globally installed command.

Impact Assessment

Successful exploitation could execute arbitrary code with the installing user's privileges. That code could read user-accessible files and credentials, modify user-owned configuration, make network requests, or alter the globally installed CLI. The documentation does not request administrator privileges, so privilege escalation to root is not established; the confirmed scope is th ...[truncated 67 chars]

Remediation

View remediation

Remediation Suggestions

• Pin mmx-cli to a specific version that has been reviewed, such as mmx-cli@x.y.z.
• Document the expected npm registry, exact package identity, and trusted publisher.
• Provide a package integrity hash or another verifiable release-signing mechanism where supported.
• Prefer a project-local dependency with a lockfile instead of a global installation.
• Disable lifecycle scripts during installation with --ignore-scripts unless the reviewed package explicitly requires them.
• Establish a controlled update process that reviews new package versions before changing the documented pin.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:16

Finding

API Keys Are Passed Through Command-Line Arguments and Persisted Without Documented File Protections

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:16-19
Vulnerability Type: Insecure secret handling
Risk Level: Medium

Vulnerable code:

bash

# Auth (persisted to ~/.mmx/credentials.json)
mmx auth login --api-key sk-xxxxx

# Or pass per-call
mmx text chat --api-key sk-xxxxx --message "Hello"

Technical Analysis

The examples encourage placing a MiniMax API key directly in a command-line argument. After a placeholder is replaced with a real key, the secret may be exposed through shell history, process inspection, terminal capture, CI logs, debugging telemetry, or agent transcripts.

Persistent authentication is legitimate for the Skill's declared API functionality, and the storage path is disclosed. However, the documentation does not require restrictive permissions for ~/.mmx/credentials.json, state whether the credential is encrypted, or explain how to rotate and revoke a compromised key. Direct access to a MiniMax credential is necessary for authenticated requests, but disclosure through process arguments is not the minimum exposure required.

Attack Path

1. A user replaces sk-xxxxx with a valid MiniMax API key.
2. The user executes one of the documented commands in a shell, CI task, or agent environment.
3. The command or its arguments are retained in shell history, logs, process metadata, or a transcript.
4. Another local user, log reader, compromised process, or unauthorized operator obtains the exposed key.
5. The attacker submits authenticated MiniMax API requests using the stolen credential until it is revoked or expires.
6. If the persisted credentials file has overly broad permissions, an attacker with local file access may alternatively read the key from ~/.mmx/credentials.json.

Impact Assessment

A stolen key could allow unauthorized use of MiniMax API functions available to the associated account, including content generation, search, vision processing, quota c ...[truncated 277 chars]

Remediation

View remediation

Remediation Suggestions

• Do not place literal API keys in command-line arguments.
• Accept credentials through hidden interactive input, standard input, or integration with an operating-system or CI secret manager.
• If environment-variable injection is supported, explain that it must be performed by the secret-management platform rather than through a shell command that records the value.
• Ensure ~/.mmx is accessible only to its owner and create credentials.json with mode 0600 on POSIX systems.
• Prefer operating-system credential stores or encrypted secret storage over a plaintext JSON file.
• Prevent secrets from appearing in application logs, error messages, telemetry, and agent transcripts.
• Document credential revocation, rotation, logout, and secure deletion procedures.
• Recommend a dedicated, least-privileged API key with spending and quota limits where the provider supports them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

Persisting API credentials in a predictable file under the home directory creates a concrete credential-access surface. If the host is multi-user, compromised, backed up insecurely, or if file permissions are weak, an attacker could steal the MiniMax API key and abuse account resources or access associated data.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

# Install
npm install -g mmx-cli

# Auth (persisted to ~/.mmx/credentials.json)
mmx auth login --api-key sk-xxxxx

# Or pass per-call

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: mmx-cli
description: Use mmx to generate text, images, video, speech, and music via the MiniMax AI platform. Use when the user wants to create media content, chat with MiniMax models, perform web search, or manage MiniMax API resources from the terminal.
---

# MiniMax CLI — Agent Skill Guide

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description says to use the skill when the user wants to "create media content" or "perform web search," which are very broad intents that overlap with many ordinary requests. The trigger scope is not constrained to cases where the MiniMax CLI or terminal-based MiniMax resource management is specifically desired, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly states that authentication is persisted to ~/.mmx/credentials.json but does not warn about the security implications of writing long-lived API credentials to disk. In agent or shared environments, persistent plaintext credentials can be exposed through filesystem access, backups, logs, or later unintended reuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The examples place API keys directly on the command line, which can leak secrets via shell history, process listings, CI logs, telemetry, and copied transcripts. In an agent context, this is especially risky because commands may be logged verbatim or surfaced to users/operators.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md

| `--output json` | Machine-readable JSON output |
| `--async` | Return task ID immediately (video generation) |
| `--dry-run` | Preview the API request without executing |
| `--yes` | Skip confirmation prompts |

---

Static analysis

No suspicious patterns detected.