Music Creator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:10 AM UTC
• Version: 2.1.0

Overview

The skill is mostly a coherent AI music workflow, but it packages a plaintext API key and asks agents to perform broad installs, credential handling, and deployment with weak scoping.

Review before installing. Do not use the bundled config.json credential; revoke and remove it if you control it. Provide MiniMax credentials only through a secure secret mechanism, avoid global or system-level installs unless you approve them, and confirm the exact files and destination before running the deployment step.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: config.json:9
• Finding: Plaintext MiniMax API Credential Committed to Configuration<![CDATA[ ## Vulnerability Details **File Location**: `config.json:9` **Vulnerability Type**: Hardcoded secret / plaintext sensitive credential **Risk Level**: High ### Vulnerable Code ```json { "artist": "传澈", "credits": { "lyrics": "传澈", "compose": "传澈", "sing": "风吟", "produce": "传澈" }, "minimax_api_key": "[REDACTED EXPOSED sk-cp- CREDENTIAL]" } ``` The credential value is intentionally redacted from this report to prevent further disclosure. The audited file contains the complete plaintext value. ### Technical Analysis A live-looking MiniMax API credential is stored directly in a project configuration file. Any person or process able to download the project, inspect a packaged Skill, access a repository clone, read an artifact cache, or retrieve repository history can recover the credential without authentication. The scripts reviewed during this audit do not directly read or transmit this field. Nevertheless, committing a secret to a distributable project is independently exploitable because the credential can be extracted and used outside the Skill. Removing it from only the current revision would also be insufficient if previous revisions, build artifacts, or caches remain accessible. ### Attack Path 1. An attacker obtains the Skill archive, repository contents, build artifact, or historical revision. 2. The attacker opens `config.json`. 3. The attacker extracts the plaintext `minimax_api_key` value. 4. The attacker submits the key to MiniMax-compatible API or CLI endpoints. 5. If the key remains valid, the attacker consumes its quota and accesses any API capabilities authorized to that credential. No local code execution is required to exploit this issue. ### Impact Assessment Successful exploitation may provide unauthorized use of the associated MiniMax account's API privileges. The precise scope depends on server-side permissions assigned to the key, but may include: - Unauthorized model requests - Quota exhaustion ...[truncated 377 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Revoke the exposed credential immediately through the MiniMax account console. 2. Generate a replacement credential with only the minimum permissions and quota required. 3. Remove the credential from `config.json` and all distributable packages. 4. Purge it from version-control history, release archives, CI artifacts, logs, caches, and mirrors where feasible. 5. Load the replacement from a protected source, such as: - An environment variable - An operating-system credential store - A managed secrets service - The authenticated `mmx` CLI credential store 6. Commit only a non-sensitive template such as `config.example.json`. 7. Add `config.json` and other local secret files to `.gitignore`. 8. Add automated secret scanning to pre-commit and CI workflows. 9. Monitor account activity and billing for unauthorized requests made with the exposed key. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:40
• Finding: Automatic Installation of Unpinned Third-Party Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:40-83` **Vulnerability Type**: Unpinned dependency installation and unsafe supply-chain execution **Risk Level**: Medium ### Vulnerable Code ```bash # Install mmx CLI npm install -g mmx-cli # Authenticate API Key mmx auth login --api-key <USER_PROVIDED_API_KEY> # Verify mmx text chat --model MiniMax-M2.7 --message "test" --output json ``` The dependency installation table additionally instructs the Agent to execute: ```bash npm install -g mmx-cli pip install openai-whisper pip install 'numpy<2' && pip install aeneas --no-build-isolation yum install -y espeak-ng espeak-ng-devel apt install ffmpeg pip install Pillow ``` The documented Aeneas installation procedure also contains: ```bash pip install 'numpy<2' && \ ln -sf /usr/lib64/libespeak-ng.so /usr/lib64/libespeak.so && \ pip install aeneas --no-build-isolation ``` ### Technical Analysis The Skill directs an Agent to install mutable package versions automatically without exact version pins, integrity hashes, a lockfile, or publisher verification. Package installation can execute package lifecycle hooks, setup scripts, native build logic, and imported build backends with the privileges of the invoking user. The global npm installation broadens the affected environment, while `--no-build-isolation` causes the Aeneas build to use packages from the existing Python environment. The documentation also includes operating-system package installation and modification of `/usr/lib64`, which will generally require elevated privileges. No evidence establishes that the named packages are currently malicious. The vulnerability is that the effective code installed in the future can differ from the code reviewed today, and the procedure lacks controls that would detect or constrain a compromised, replaced, or unexpectedly changed release. ### Attack Path 1. A dependency publisher account, package registry entry, release pipeline, or transitive depend ...[truncated 1443 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every dependency to a reviewed exact version. 2. Use lockfiles and cryptographic hashes where supported: - npm lockfiles with integrity metadata - Python requirements generated with hashes - Version-locked operating-system packages where practical 3. Install Python packages inside a dedicated virtual environment. 4. Avoid `npm install -g`; use a project-local dependency and invoke it through a controlled package script or `npx` with a pinned version. 5. Avoid `--no-build-isolation` unless its necessity is documented and all build dependencies are pinned and reviewed. 6. Verify package names, registry origins, publisher identities, signatures, and checksums before installation. 7. Require explicit user approval before installing packages or making system-wide changes. 8. Perform dependency installation in a sandbox or disposable container with restricted filesystem and network access. 9. Separate privileged operating-system setup from normal Skill execution. 10. Replace the manual `/usr/lib64` symbolic-link modification with a packaged, platform-specific setup process that validates the destination and requires informed administrator approval. 11. Add software-composition analysis and periodic dependency vulnerability scanning. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/calibrate_lyrics.py:543
• Finding: Predictable Shared Temporary Directories Permit Symlink and Data-Collision Attacks<![CDATA[ ## Vulnerability Details **File Location**: `scripts/calibrate_lyrics.py:543-544` **Additional Locations**: `scripts/calibrate_lyrics.py:227-244`, `scripts/calibrate_lyrics_v2.py:403-404`, `scripts/align_lyrics.py:232-233` **Vulnerability Type**: Unsafe predictable temporary-file handling **Risk Level**: Low ### Vulnerable Code The primary calibration script creates a predictable directory derived from the song title: ```python if args.workdir: workdir = args.workdir else: slug = slugify(args.title) workdir = f"/tmp/calibrate-{slug}" os.makedirs(workdir, exist_ok=True) logger.info("工作目录: %s", workdir) ``` It later creates predictable child paths without exclusive creation or symbolic-link checks: ```python aeneas_dir = os.path.join(workdir, "aeneas") os.makedirs(aeneas_dir, exist_ok=True) aeneas_input = os.path.join(aeneas_dir, "input.txt") with open(aeneas_input, "w", encoding="utf-8") as f: f.write(plain_text) aeneas_output = os.path.join(aeneas_dir, "map.json") ``` The alternative calibration script uses the same pattern: ```python if args.workdir: workdir = args.workdir else: slug = slugify(args.title) workdir = f"/tmp/calibrate-{slug}" os.makedirs(workdir, exist_ok=True) ``` The legacy alignment script also derives a shared temporary path from the input basename: ```python output_dir = f'/tmp/whisper-{os.path.splitext(os.path.basename(args.mp3))[0]}' asr_path = run_whisper(args.mp3, output_dir) ``` ### Technical Analysis Directories under shared `/tmp` are named using predictable title or filename values and are created with `exist_ok=True`. The code therefore accepts a pre-existing path rather than atomically creating a private temporary directory. Subsequent writes use ordinary `open(..., "w")`, which follows symbolic links. A local attacker who can write to the shared temporary namespace may pre-create the expected directory structure and place symbolic links at predictable child paths. The process ...[truncated 2084 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace predictable paths with a securely created private directory: ```python import tempfile with tempfile.TemporaryDirectory(prefix="music-calibrate-") as workdir: # Perform processing inside the private directory. ... ``` 2. If intermediate files must persist, use `tempfile.mkdtemp()` and set directory permissions to `0o700`. 3. Create sensitive files atomically and exclusively using `os.open()` with `O_CREAT | O_EXCL` and restrictive permissions. 4. Reject symbolic links and unexpected pre-existing paths before reading or writing. 5. Where supported, use `O_NOFOLLOW` when opening files. 6. Do not derive security-sensitive temporary names solely from user-controlled titles or filenames. 7. Validate a caller-supplied `--workdir` and document that it must be a trusted, private directory. 8. Delete intermediate ASR and alignment data after use unless retention is explicitly requested. 9. Avoid running these media-processing scripts with administrative privileges. 10. Add tests that pre-create directories, files, and symbolic links to confirm that unsafe paths are rejected. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (32)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared description presents a broad end-to-end AI music creation skill with content generation, media generation, lyric synchronization, page creation, and deployment. The supplied code chunk implements only one narrow subset: lyric timing alignment using Whisper output (or by invoking Whisper on an MP3) and writing a JSON result. While this partially overlaps with the claimed ASR alignment portion, it does not support the primary declared purpose of full music creation and publishing. This is therefore a material description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a comprehensive AI music production pipeline, but the supplied code chunk only constructs a JSON metadata file from command-line arguments and saves it locally. While song metadata could be a supporting part of a music workflow, this code alone does not implement any of the core advertised capabilities. The primary purpose of the code is materially narrower and different from the declared skill behavior, so this is a clear description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description presents a broad full-process music creation skill, but the provided code only implements one narrow component: lyric-to-audio alignment and LRC file generation. That alone would be acceptable as a partial implementation if the description were scoped accordingly, but the declared primary purpose emphasizes additional major capabilities—lyric writing, music generation, cover art generation, synced playback page creation, and deployment—that are absent from this code chunk. Additionally, the code comments/docstring claim 'MFCC + DTW' optimization, yet the implementation imports librosa/numpy/scipy distance tools without actually computing MFCCs or running DTW; instead it uses Whisper word timestamps plus a simple sliding-window text match and fallback interpolation. Therefore the description does not accurately represent what this code chunk actually does.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill asks the user to provide an API key directly and then uses it for CLI authentication without explaining storage, retention, redaction, or exposure risks. In agent environments, plaintext credential handling can leak secrets through logs, shell history, config files, screenshots, or subsequent tool output.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The skill directs automatic installation of packages and system-level modifications, including package-manager use and library symlinks, without warning about host integrity, privilege needs, or rollback concerns. This can break environments, widen supply-chain exposure, and surprise users with invasive changes beyond the expected task scope.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

# 登录 API Key
mmx auth login --api-key <用户提供的API_KEY>
# 验证
mmx text chat --model MiniMax-M2.7 --message "test" --output json
```

用户提供创作人信息后，Agent 在技能目录创建 `config.json`：

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

使用 MiniMax 文本模型生成歌词：

```bash
mmx text chat --model MiniMax-M2.7 --message "PROMPT" --output json
```

**Prompt 模板：**

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The deployment workflow pushes generated artifacts to an external deployment target without clearly warning the user that content may become publicly accessible. Since files include audio, images, lyrics, and metadata, this can result in unintended publication and data disclosure.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

]
    result = subprocess.run(
        cmd, capture_output=True, text=True, timeout=30,
        env={**os.environ, "PYTHONIOENCODING": "UTF-8"},
    )
    if result.returncode != 0:
        raise RuntimeError(f"ffprobe 执行失败: {result.stderr}")

• Confidence: 60% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

]
    result = subprocess.run(
        cmd, capture_output=True, text=True, timeout=30,
        env={**os.environ, "PYTHONIOENCODING": "UTF-8"},
    )
    if result.returncode != 0:
        raise RuntimeError(f"ffprobe 执行失败: {result.stderr}")

• Confidence: 60% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

]
    result = subprocess.run(
        cmd, capture_output=True, text=True, timeout=30,
        env={**os.environ, "PYTHONIOENCODING": "UTF-8"},
    )
    if result.returncode != 0:
        raise RuntimeError(f"ffprobe 执行失败: {result.stderr}")

• Confidence: 60% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

]
    result = subprocess.run(
        cmd, capture_output=True, text=True, timeout=30,
        env={**os.environ, "PYTHONIOENCODING": "UTF-8"},
    )
    if result.returncode != 0:
        raise RuntimeError(f"ffprobe 执行失败: {result.stderr}")

• Confidence: 60% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill describes shell execution, file reads/writes, environment use, package installation, and deployment actions, but it declares no explicit tool scope or permission boundaries. In an agent setting, this increases the chance that broad capabilities are invoked implicitly, making sensitive operations harder to review and constrain.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list includes broad everyday phrases, which can cause the skill to activate in contexts the user did not intend. Because this skill can request credentials, install software, write files, and publish content, accidental invocation materially increases security and privacy risk.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs the agent to collect and handle a user's API key in ordinary conversation, then pass it into authentication commands. Secret collection through chat and direct command-line use is dangerous because it increases the chance of leakage through transcripts, terminal history, process inspection, or reused context.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to perform global npm and pip installs, OS package installation, and a system library symlink change. These are privileged, system-wide modifications unrelated to a minimally scoped content-creation task and can damage system integrity, introduce supply-chain risk, or alter shared runtime behavior.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: L157 明确要求“写歌词，主题是《{主题}》”且指定为“中文歌曲”，文档中未提供按用户偏好选择语言的选项，也未说明该技能仅限中文场景的必要性。根据语言/locale 政策，这属于未获用户选择的语言强制约束。

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill extends beyond music creation into publication by copying artifacts into another skill's deployment directory and triggering a sync to deploy. This broadens the blast radius from local file generation to external content publication, creating risk of accidental data exposure or unauthorized site changes.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The subprocess command hard-codes `--language zh`, which imposes a specific language/locale behavior on all runs. The file does not provide a user-facing option to choose another language or explain that this tool is intentionally restricted to Chinese-only usage.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

'--device', 'cpu'
    ]
    print(f"🎵 Running ASR: {' '.join(cmd)}")
    subprocess.run(cmd, check=True)

    # 找到输出文件
    base = os.path.splitext(os.path.basename(mp3_path))[0]

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if args.duration:
        total_duration = args.duration
    elif args.mp3:
        result = subprocess.run(
            ['ffprobe', '-v', 'error', '-show_entries', 'format=duration', '-of', 'csv=p=0', args.mp3],
            capture_output=True, text=True
        )

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The command hardcodes `--language zh`, which enforces a specific language/locale behavior regardless of the input audio or user preference. This is a natural-language policy concern because the file does not offer opt-in, configurability, or a documented region-specific justification for restricting processing to Chinese.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"-show_format",
        mp3_path,
    ]
    result = subprocess.run(
        cmd, capture_output=True, text=True, timeout=30,
        env={**os.environ, "PYTHONIOENCODING": "UTF-8"},
    )

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"-show_format",
        mp3_path,
    ]
    result = subprocess.run(
        cmd, capture_output=True, text=True, timeout=30,
        env={**os.environ, "PYTHONIOENCODING": "UTF-8"},
    )

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""运行子进程并记录日志"""
    logger.info("▶ %s: %s", description, " ".join(cmd))
    env = {**os.environ, "PYTHONIOENCODING": "UTF-8"}
    result = subprocess.run(
        cmd, capture_output=True, text=True, timeout=timeout, env=env,
    )
    if result.returncode != 0:

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Static analysis

No suspicious patterns detected.