Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

MiniMax Music Generation

v1.0.0

Generate AI music using MiniMax Music 2.5 API. Use when the user wants to: (1) generate instrumental/pure music, (2) generate songs with lyrics, (3) generate...

1· 236·3 current·3 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for rexdong1/minimax-music.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "MiniMax Music Generation" (rexdong1/minimax-music) from ClawHub.
Skill page: https://clawhub.ai/rexdong1/minimax-music
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install minimax-music

ClawHub CLI

Package manager switcher

npx clawhub@latest install minimax-music
Security Scan
Capability signals
Crypto
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill's name, description, CLI, and Python code all consistently implement music generation via a MiniMax Music API — that part is coherent. However the registry metadata declares no required environment variables while both SKILL.md and the script require MINIMAX_API_KEY (or --api-key). This manifest mismatch reduces trust and is an inconsistency that should be corrected.
!
Instruction Scope
SKILL.md and the CLI focus on generating and downloading audio, which is in-scope. But SKILL.md includes a Feishu upload/send example that would transmit the generated audio to an external service using TENANT_ACCESS_TOKEN and USER_OPEN_ID — these credentials are neither declared in the manifest nor present in the code. The presence of that snippet means audio could be sent to an external endpoint if the operator provides those tokens; the skill does not clearly document or request those tokens in its metadata.
Install Mechanism
No install spec — instruction-only skill with one Python script. It depends on the widely used 'requests' library (the script prints a pip install hint). This is a low-install-risk setup (no untrusted downloads or extracted archives).
!
Credentials
The only credential the code requires is MINIMAX_API_KEY (appropriate for calling the MiniMax API), which is proportionate to the stated purpose. But the manifest lists no required env vars (contradiction). Additionally, SKILL.md shows a Feishu example that would require TENANT_ACCESS_TOKEN and USER_OPEN_ID (not declared). The omission of those env var requirements in the metadata and the undocumented external upload path are disproportionate to what's advertised.
Persistence & Privilege
No elevated privileges requested. always is false and the skill does not modify other skills or global agent configuration. It writes generated audio to user-specified directories (expected behavior).
What to consider before installing
Key points before installing: (1) Demand that the skill manifest be corrected to declare MINIMAX_API_KEY as a required env var (and any other tokens it needs). (2) Verify the MiniMax API domain (https://api.minimaxi.com) and confirm you trust that service and its privacy/retention policies before providing an API key. (3) Be cautious about the Feishu upload snippet — it would transmit generated audio to an external account if you provide TENANT_ACCESS_TOKEN/USER_OPEN_ID; those tokens are not declared in the skill metadata, so only provide them if you explicitly intend uploads to Feishu. (4) If you need stronger assurance, request the skill author publish a homepage or source repo, or run the script in a sandboxed environment and review runtime network traffic. (5) If you don't trust the unknown owner or service, avoid supplying credentials and use an isolated test account or local-only mode (no Feishu upload) instead.

Like a lobster shell, security has layers — review code before you run it.

latestvk970xccmm40tqtyp2vghxf487d84cwwd
236downloads
1stars
1versions
Updated 3w ago
v1.0.0
MIT-0

MiniMax Music Generation

Generate AI music using MiniMax Music 2.5 API.

Prerequisites

Set the MINIMAX_API_KEY environment variable:

export MINIMAX_API_KEY="your-api-key-here"

Quick Start

# Generate instrumental music
python3 ~/.openclaw/workspace/skills/minimax-music/scripts/minimax_music.py create \
  --prompt "Piano, Relaxing, Meditative" \
  --instrumental \
  --download ~/Music

# Generate song with lyrics
python3 ~/.openclaw/workspace/skills/minimax-music/scripts/minimax_music.py create \
  --prompt "Pop, Upbeat, Celebratory" \
  --lyrics "[Verse]\n阳光洒满大地\n[Chorus]\n快乐每一天" \
  --download ~/Music

# Generate lyrics first
python3 ~/.openclaw/workspace/skills/minimax-music/scripts/minimax_music.py lyrics \
  --prompt "一首关于春天的歌" \
  --output lyrics.txt

Music Generation Parameters

ParameterDescriptionDefault
--promptMusic style description (required)-
--lyricsLyrics text with [Verse], [Chorus] markers-
--lyrics-filePath to lyrics file-
--instrumentalGenerate instrumental music (no vocals)false
--sample-rateAudio quality: 44100, 4800044100
--bitrateAudio bitrate: 128000, 256000, 320000256000
--formatOutput format: mp3, wav, flacmp3
--downloadDirectory to save audio file-
--modelModel IDmusic-2.5

Prompt Examples

Instrumental Music

# Relaxing piano
--prompt "Piano, Relaxing, Meditative, Soft, Ambient"

# Electronic ambient
--prompt "Electronic, Ambient, Atmospheric, Synthesizer, Chill"

# Orchestral
--prompt "Orchestra, Cinematic, Epic, Strings, Brass"

# Jazz
--prompt "Jazz, Smooth, Saxophone, Piano, Night Club"

Songs with Lyrics

# Chinese pop
--prompt "Mandopop, Emotional, Ballad" \
--lyrics "[Verse]\n夜深人静\n思念着你\n[Chorus]\n心中的爱\n永不改变"

# English pop
--prompt "Pop, Upbeat, Energetic" \
--lyrics "[Verse]\nWalking down the street\nFeeling the beat\n[Chorus]\nLet's celebrate tonight"

Lyrics Format

Use section markers to structure the song:

[Intro]
(Instrumental opening)

[Verse]
Main lyrics here

[Pre-Chorus]
Build-up section

[Chorus]
Main hook/refrain

[Bridge]
Contrast section

[Outro]
Ending section

Daily Quota

MiniMax Token Plan subscriptions include:

  • music-2.5: 7 generations/day (Plan 199)
  • Quota resets daily at midnight

Sending Audio via Feishu

After generating music, send to user's Feishu:

import requests

# 1. Upload audio file
with open("music.mp3", "rb") as f:
    upload_resp = requests.post(
        "https://open.feishu.cn/open-apis/im/v1/files",
        headers={"Authorization": f"Bearer {TENANT_ACCESS_TOKEN}"},
        files={"file": ("music.mp3", f, "audio/mpeg")},
        data={"file_type": "stream", "file_name": "music.mp3"}
    )
file_key = upload_resp.json()["data"]["file_key"]

# 2. Send file message
requests.post(
    "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id",
    headers={"Authorization": f"Bearer {TENANT_ACCESS_TOKEN}", "Content-Type": "application/json"},
    json={
        "msg_type": "file",
        "content": json.dumps({"file_key": file_key}),
        "receive_id": USER_OPEN_ID
    }
)

Rules

  1. Always check MINIMAX_API_KEY is set before API calls.
  2. Use --instrumental for pure music without vocals.
  3. Default to 44100 Hz, 256 kbps, MP3 format for good quality and compatibility.
  4. Download immediately - audio URLs expire after some time.
  5. Respect daily quota - inform user if they've hit their limit.
  6. Provide audio file to user after generation (download + share via Feishu if applicable).

Comments

Loading comments...