Minimax-Multimodal-Toolkit

Use mmx to generate text, images, video, speech, and music via the MiniMax AI platform. Use when the user wants to create media content, chat with MiniMax mo...

Security Scan

The skill's instructions match its stated purpose (a CLI for MiniMax), but the SKILL.md expects the user/agent to supply and persist an API key to ~/.mmx/credentials.json and to install a global npm package, while the registry metadata declares no required credentials or config paths — an incoherence worth caution.

Purpose & Capability

The name/description (generate text/images/video/speech/music via MiniMax) aligns with the runtime instructions: commands, flags, and examples all describe a multipurpose MiniMax CLI. No unrelated service or capability is requested.

Instruction Scope

The SKILL.md instructs the agent/user to run 'npm install -g mmx-cli' and to authenticate with an API key (mmx auth login --api-key sk-xxxxx) which will be persisted to ~/.mmx/credentials.json. The registry metadata lists no required env vars or config paths, so the instructions require storing credentials and potentially reading/writing files that were not declared. The CLI also accepts file inputs (e.g., --messages-file, --text-file, --first-frame) and callback URLs for async video tasks; these allow reading local files or transmitting data to arbitrary endpoints, which is expected for a CLI but increases the attack/exfiltration surface if the skill is invoked with untrusted inputs.

Install Mechanism

There is no install spec in the registry (instruction-only), which is low risk from the skill bundle perspective. However, the guide tells the agent to perform a global npm install (npm install -g mmx-cli). Global npm installs modify the host and pull code from the npm registry (moderate risk); the skill metadata does not document or pin a package source. Users should verify the npm package's origin before running it.

Credentials

Registry metadata declares no required env vars or primary credential, but the instructions clearly require an API key (sk-xxxxx) and describe persisting it to ~/.mmx/credentials.json. This is a mismatch: a secret is necessary for normal use but was not declared. The CLI also permits supplying callback URLs and reading file paths, increasing the potential for sensitive-data transmission if misused.

Persistence & Privilege

The skill itself is not 'always' present and is user-invocable (normal). However, the recommended 'mmx auth login' will persist credentials to the user's home (~/.mmx/credentials.json), creating durable secrets on disk that the agent (or other processes) could access. The registry metadata did not declare this config path or credential persistence, creating a transparency gap.

What to consider before installing

This skill appears to be a CLI usage guide for the MiniMax 'mmx' tool and is plausibly what it claims, but it has an important mismatch: the SKILL.md expects an API key and persistence to ~/.mmx/credentials.json, while the registry metadata declares no required credentials or config paths. Before installing or using this skill: 1) Verify the skill's origin and the npm package 'mmx-cli' on the npm registry/GitHub — prefer official project pages and pinned releases. 2) Prefer per-call --api-key usage rather than running 'mmx auth login' if you don't want credentials persisted; inspect ~/.mmx/credentials.json and its file permissions if you do authenticate. 3) Avoid running 'npm install -g' on unverified packages; consider installing in an isolated container or virtual environment. 4) Be cautious with callback URLs and file arguments (they can exfiltrate content) and never supply sensitive local file paths unless you trust the target. 5) Ask the publisher to update registry metadata to declare the required API key/config path explicitly so the skill's requirements are transparent.

MiniMax CLI — Agent Skill Guide

Use mmx to generate text, images, video, speech, music, and perform web search via the MiniMax AI platform.

Prerequisites

# Install
npm install -g mmx-cli

# Auth (persisted to ~/.mmx/credentials.json)
mmx auth login --api-key sk-xxxxx

# Or pass per-call
mmx text chat --api-key sk-xxxxx --message "Hello"

Region is auto-detected. Override with --region global or --region cn.

---

Agent Flags

Always use these flags in non-interactive (agent/CI) contexts:

Flag	Purpose
--non-interactive	Fail fast on missing args instead of prompting
--quiet	Suppress spinners/progress; stdout is pure data
--output json	Machine-readable JSON output
--async	Return task ID immediately (video generation)
--dry-run	Preview the API request without executing
--yes	Skip confirmation prompts

---

Commands

text chat

Chat completion. Default model: MiniMax-M2.7.

mmx text chat --message <text> [flags]

Flag	Type	Description
--message <text>	string, required, repeatable	Message text. Prefix with role: to set role (e.g. "system:You are helpful", "user:Hello")
--messages-file <path>	string	JSON file with messages array. Use - for stdin
--system <text>	string	System prompt
--model <model>	string	Model ID (default: MiniMax-M2.7)
--max-tokens <n>	number	Max tokens (default: 4096)
--temperature <n>	number	Sampling temperature (0.0, 1.0]
--top-p <n>	number	Nucleus sampling threshold
--stream	boolean	Stream tokens (default: on in TTY)
--tool <json-or-path>	string, repeatable	Tool definition JSON or file path

# Single message
mmx text chat --message "user:What is MiniMax?" --output json --quiet

# Multi-turn
mmx text chat \
  --system "You are a coding assistant." \
  --message "user:Write fizzbuzz in Python" \
  --output json

# From file
cat conversation.json | mmx text chat --messages-file - --output json

stdout: response text (text mode) or full response object (json mode).

---

image generate

Generate images. Model: image-01.

mmx image generate --prompt <text> [flags]

Flag	Type	Description
--prompt <text>	string, required	Image description
--aspect-ratio <ratio>	string	e.g. 16:9, 1:1
--n <count>	number	Number of images (default: 1)
--subject-ref <params>	string	Subject reference: type=character,image=path-or-url
--out-dir <dir>	string	Download images to directory
--out-prefix <prefix>	string	Filename prefix (default: image)

mmx image generate --prompt "A cat in a spacesuit" --output json --quiet
# stdout: image URLs (one per line in quiet mode)

mmx image generate --prompt "Logo" --n 3 --out-dir ./gen/ --quiet
# stdout: saved file paths (one per line)

---

video generate

Generate video. Default model: MiniMax-Hailuo-2.3. This is an async task — by default it polls until completion.

mmx video generate --prompt <text> [flags]

Flag	Type	Description
--prompt <text>	string, required	Video description
--model <model>	string	MiniMax-Hailuo-2.3 (default) or MiniMax-Hailuo-2.3-Fast
--first-frame <path-or-url>	string	First frame image
--callback-url <url>	string	Webhook URL for completion
--download <path>	string	Save video to specific file
--async	boolean	Return task ID immediately
--no-wait	boolean	Same as --async
--poll-interval <seconds>	number	Polling interval (default: 5)

# Non-blocking: get task ID
mmx video generate --prompt "A robot." --async --quiet
# stdout: {"taskId":"..."}

# Blocking: wait and get file path
mmx video generate --prompt "Ocean waves." --download ocean.mp4 --quiet
# stdout: ocean.mp4

video task get

Query status of a video generation task.

mmx video task get --task-id <id> [--output json]

video download

Download a completed video by task ID.

mmx video download --file-id <id> [--out <path>]

---

speech synthesize

Text-to-speech. Default model: speech-2.8-hd. Max 10k chars.

mmx speech synthesize --text <text> [flags]

Flag	Type	Description
--text <text>	string	Text to synthesize
--text-file <path>	string	Read text from file. Use - for stdin
--model <model>	string	speech-2.8-hd (default), speech-2.6, speech-02
--voice <id>	string	Voice ID (default: English_expressive_narrator)
--speed <n>	number	Speed multiplier
--volume <n>	number	Volume level
--pitch <n>	number	Pitch adjustment
--format <fmt>	string	Audio format (default: mp3)
--sample-rate <hz>	number	Sample rate (default: 32000)
--bitrate <bps>	number	Bitrate (default: 128000)
--channels <n>	number	Audio channels (default: 1)
--language <code>	string	Language boost
--subtitles	boolean	Include subtitle timing data
--pronunciation <from/to>	string, repeatable	Custom pronunciation
--sound-effect <effect>	string	Add sound effect
--out <path>	string	Save audio to file
--stream	boolean	Stream raw audio to stdout

mmx speech synthesize --text "Hello world" --out hello.mp3 --quiet
# stdout: hello.mp3

echo "Breaking news." | mmx speech synthesize --text-file - --out news.mp3

---

music generate

Generate music. Model: music-2.5. Responds well to rich, structured descriptions.

mmx music generate --prompt <text> [--lyrics <text>] [flags]

Flag	Type	Description
--prompt <text>	string	Music style description (can be detailed)
--lyrics <text>	string	Song lyrics with structure tags. Use "\u65e0\u6b4c\u8bcd" for instrumental. Cannot be used with --instrumental
--lyrics-file <path>	string	Read lyrics from file. Use - for stdin
--vocals <text>	string	Vocal style, e.g. "warm male baritone", "bright female soprano", "duet with harmonies"
--genre <text>	string	Music genre, e.g. folk, pop, jazz
--mood <text>	string	Mood or emotion, e.g. warm, melancholic, uplifting
--instruments <text>	string	Instruments to feature, e.g. "acoustic guitar, piano"
--tempo <text>	string	Tempo description, e.g. fast, slow, moderate
--bpm <number>	number	Exact tempo in beats per minute
--key <text>	string	Musical key, e.g. C major, A minor, G sharp
--avoid <text>	string	Elements to avoid in the generated music
--use-case <text>	string	Use case context, e.g. "background music for video", "theme song"
--structure <text>	string	Song structure, e.g. "verse-chorus-verse-bridge-chorus"
--references <text>	string	Reference tracks or artists, e.g. "similar to Ed Sheeran"
--extra <text>	string	Additional fine-grained requirements
--instrumental	boolean	Generate instrumental music (no vocals). Cannot be used with --lyrics or --lyrics-file
--aigc-watermark	boolean	Embed AI-generated content watermark
--format <fmt>	string	Audio format (default: mp3)
--sample-rate <hz>	number	Sample rate (default: 44100)
--bitrate <bps>	number	Bitrate (default: 256000)
--out <path>	string	Save audio to file
--stream	boolean	Stream raw audio to stdout

At least one of --prompt or --lyrics is required.

# Simple usage
mmx music generate --prompt "Upbeat pop" --lyrics "La la la..." --out song.mp3 --quiet

# Detailed prompt with vocal characteristics
mmx music generate --prompt "Warm morning folk" \
  --vocals "male and female duet, harmonies in chorus" \
  --instruments "acoustic guitar, piano" \
  --bpm 95 \
  --lyrics-file song.txt \
  --out duet.mp3

# Instrumental (use --instrumental flag)
mmx music generate --prompt "Cinematic orchestral, building tension" --instrumental --out bgm.mp3

---

vision describe

Image understanding via VLM. Provide either --image or --file-id, not both.

mmx vision describe (--image <path-or-url> | --file-id <id>) [flags]

Flag	Type	Description
--image <path-or-url>	string	Local path or URL (auto base64-encoded)
--file-id <id>	string	Pre-uploaded file ID (skips base64)
--prompt <text>	string	Question about the image (default: "Describe the image.")

mmx vision describe --image photo.jpg --prompt "What breed?" --output json

stdout: description text (text mode) or full response (json mode).

---

search query

Web search via MiniMax.

mmx search query --q <query>

Flag	Type	Description
--q <query>	string, required	Search query

mmx search query --q "MiniMax AI" --output json --quiet

---

quota show

Display Token Plan usage and remaining quotas.

mmx quota show [--output json]

---

Tool Schema Export

Export all commands as Anthropic/OpenAI-compatible JSON tool schemas:

# All tool-worthy commands (excludes auth/config/update)
mmx config export-schema

# Single command
mmx config export-schema --command "video generate"

Use this to dynamically register mmx commands as tools in your agent framework.

---

Exit Codes

Code	Meaning
0	Success
1	General error
2	Usage error (bad flags, missing args)
3	Authentication error
4	Quota exceeded
5	Timeout
10	Content filter triggered

---

Piping Patterns

# stdout is always clean data — safe to pipe
mmx text chat --message "Hi" --output json | jq '.content'

# stderr has progress/spinners — discard if needed
mmx video generate --prompt "Waves" 2>/dev/null

# Chain: generate image → describe it
URL=$(mmx image generate --prompt "A sunset" --quiet)
mmx vision describe --image "$URL" --quiet

# Async video workflow
TASK=$(mmx video generate --prompt "A robot" --async --quiet | jq -r '.taskId')
mmx video task get --task-id "$TASK" --output json
mmx video download --task-id "$TASK" --out robot.mp4

---

Configuration Precedence

CLI flags → environment variables → ~/.mmx/config.json → defaults.

# Persistent config
mmx config set --key region --value cn
mmx config show

# Environment
export MINIMAX_API_KEY=sk-xxxxx
export MINIMAX_REGION=cn