ClawHub
Back to skill

Security audit

MiniMax Music Generation

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims: it uses MiniMax APIs to generate lyrics/music and saves the resulting files locally, with some security hardening gaps users should understand.

Install only if you are comfortable sending song prompts, lyrics, and related metadata to MiniMax. Use an environment variable or secret manager for MINIMAX_API_KEY instead of --api-key, avoid submitting sensitive unpublished content unless acceptable under MiniMax handling, and review downloaded audio files because the helper does not constrain the returned download URL or file size.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate_music.py:71
Finding

Unvalidated API-Controlled Audio Download Enables SSRF and Resource Exhaustion

Content
View full analysis

Vulnerability Details

File Location: scripts/generate_music.py:71-73; duplicated in scripts/create_song.py:130-132
Vulnerability Type: Server-Side Request Forgery (SSRF), unrestricted redirects, and unbounded response download
Risk Level: Medium

Vulnerable code in scripts/generate_music.py:71-73:

python
response = requests.get(audio_url, timeout=60)
with open(filepath, 'wb') as f:
    f.write(response.content)

Duplicated vulnerable code in scripts/create_song.py:130-132:

python
response = requests.get(audio_url, timeout=60)
with open(filepath, 'wb') as f:
    f.write(response.content)

The same unsafe pattern is also presented as recommended usage in SKILL.md:93-95.

Technical Analysis

The audio_url value is obtained from the MiniMax API response and passed directly to requests.get. Although the initial API endpoint is fixed, the returned download location is externally controlled data and is not validated before the local request is made.

The implementation does not:

  • Restrict the URL to HTTPS.
  • Restrict downloads to expected MiniMax or approved CDN hostnames.
  • Reject loopback, private, link-local, multicast, or reserved IP addresses.
  • Revalidate the destination after DNS resolution.
  • Validate each redirect destination; requests follows redirects by default.
  • Call raise_for_status() to reject unsuccessful responses.
  • Check that the response has an expected audio content type.
  • Stream the response with an enforced maximum size.
  • Verify that the downloaded data is a valid audio file.

The entire response is first loaded into memory through response.content and then written to disk with an .mp3 extension regardless of its actual type. A compromised API, compromised upstream account, malicious CDN response, or poisoned response path could therefore cause the machine running the Skill to issue requests to otherwise inaccessible net ...[truncated 2021 chars]

Remediation
View remediation

Remediation Suggestions

  1. Parse the returned URL and permit only https URLs.
  2. Maintain an explicit allowlist of documented MiniMax audio CDN hostnames. Do not rely on suffix checks that can be bypassed by names such as trusted.example.attacker.test.
  3. Resolve the hostname and reject every address in loopback, private, link-local, multicast, unspecified, and reserved ranges for both IPv4 and IPv6.
  4. Disable automatic redirects with allow_redirects=False, or validate the scheme, hostname, resolved addresses, and port of every redirect target before following it.
  5. Use response.raise_for_status() before creating the output file.
  6. Allow only expected audio media types and validate the downloaded file signature rather than trusting the extension or Content-Type header alone.
  7. Use stream=True, read fixed-size chunks, and stop when a strict maximum output size is reached. The limit should reflect the documented maximum expected song size.
  8. Write to a temporary file with restrictive permissions and atomically rename it only after all validation succeeds. Delete partial files on failure.
  9. Apply the same hardened helper to both generate_music.py and create_song.py, and update the unsafe example in SKILL.md.
  10. Where supported by the API, prefer inline audio data with explicit decoded-size validation over fetching an unrestricted remote URL.

T09 · Insecure Skill Coding Practices

Note
Location
scripts/generate_lyrics.py:84
Finding

API Key Can Be Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/generate_lyrics.py:84; scripts/generate_music.py:91; scripts/create_song.py:209
Vulnerability Type: Sensitive credential exposure through process arguments and shell history
Risk Level: Low

Vulnerable code in scripts/generate_lyrics.py:84:

python
parser.add_argument("--api-key", dest="api_key")

Vulnerable code in scripts/generate_music.py:91:

python
parser.add_argument("--api-key", dest="api_key")

Vulnerable code in scripts/create_song.py:209:

python
parser.add_argument("--api-key", dest="api_key")

Technical Analysis

All three scripts allow a MiniMax bearer token to be supplied directly through the --api-key command-line option. Command-line arguments are not an appropriate secret-transport mechanism because they may be retained or exposed through:

  • Shell history files.
  • Process listings and process-inspection interfaces.
  • Terminal session recording.
  • CI/CD job logs.
  • Container or orchestration metadata.
  • Monitoring, debugging, and audit tooling.
  • Wrapper scripts or task-runner logs.

The scripts also support MINIMAX_API_KEY, which is safer than a command-line argument when the environment is appropriately protected. No hardcoded API key or unrelated credential-file access was found.

Attack Path

  1. A user invokes one of the scripts with --api-key SECRET_VALUE.
  2. The full invocation is recorded in shell history, process metadata, automation logs, or monitoring output.
  3. Another local user, administrator, log reader, compromised process, or external log-system operator accesses the recorded command.
  4. The observer extracts the MiniMax bearer token.
  5. The token is used against MiniMax APIs until it is revoked, expires, or reaches its account limits.

This path requires access to local process information, command history, or collected logs. It does not independent ...[truncated 567 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the --api-key option from all three scripts.
  2. Continue supporting MINIMAX_API_KEY, while documenting that secrets should be injected through a protected runtime environment or secret manager.
  3. For interactive use, optionally read the key with getpass.getpass() so it is not echoed or stored in shell history.
  4. For automation, integrate with the platform's secret store and ensure the value is masked in logs.
  5. Never print the key or include authorization headers in exception messages, debug output, or telemetry.
  6. Use narrowly scoped credentials where MiniMax supports them, rotate keys periodically, and revoke any key previously passed through exposed command lines.
  7. If command-line compatibility must temporarily remain, emit a prominent warning and deprecate the option, but do not treat warning text as a complete security control.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (54)

Tainted flow: 'headers' from os.getenv (line 87, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/create_song.py (reported line 45)May include surrounding context.

python
}

    print(f"🎤 正在创作歌词...")
    response = requests.post(url, json=payload, headers=headers, timeout=60)
    result = response.json()

    if result.get("base_resp", {}).get("status_code") != 0:

Tainted flow: 'headers' from os.getenv (line 87, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/create_song.py (reported line 93)May include surrounding context.

python
}

    print(f"🎵 正在生成音乐...")
    response = requests.post(url, json=payload, headers=headers, timeout=180)
    result = response.json()

    if result.get("base_resp", {}).get("status_code") != 0:

Tainted flow: 'audio_url' from os.getenv (line 177, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

The script downloads from audio_url returned by an external API without validating the scheme, host, or redirect target. If that URL is malicious or compromised, the script could be abused for SSRF-like outbound requests, unexpected internal network access, or downloading arbitrary content into the user's workspace.

Content

Scanner excerpt · scripts/create_song.py (reported line 130)May include surrounding context.

python
filename = f"{safe_title}_{timestamp}.mp3"
    filepath = os.path.join(save_dir, filename)

    response = requests.get(audio_url, timeout=60)
    with open(filepath, 'wb') as f:
        f.write(response.content)

Tainted flow: 'headers' from os.getenv (line 38, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate_lyrics.py (reported line 44)May include surrounding context.

python
}

    print(f"正在生成歌词 ({mode})...")
    response = requests.post(url, json=payload, headers=headers, timeout=60)
    result = response.json()

    if result.get("base_resp", {}).get("status_code") != 0:

Tainted flow: 'headers' from os.getenv (line 49, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate_music.py (reported line 55)May include surrounding context.

python
}

    print(f"正在生成音乐...")
    response = requests.post(url, json=payload, headers=headers, timeout=180)
    result = response.json()

    if result.get("base_resp", {}).get("status_code") != 0:

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

代码的实际主功能是歌词生成与编辑，而非完整的音乐创作流程。它只向 https://api.minimaxi.com/v1/lyrics_generation 发送请求，接收歌词结果，并保存到本地文本文件。虽然这与声明中的“歌词生成、续写或编辑歌词”部分一致，但声明的核心范围明显更广，包含音乐生成、翻唱、纯音乐、完整歌曲一站式流程、以及特定音乐模型支持；这些在代码中均未体现。因此描述对能力范围有实质性夸大，属于描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The implementation partially matches the declared purpose: it does support music generation, accepts optional lyrics, supports instrumental mode, and exposes the declared music models including cover variants. However, the description prominently claims integrated lyric generation and a complete song-creation workflow using both lyrics and music endpoints. This code never calls /v1/lyrics_generation, contains no logic for generating, continuing, or editing lyrics, and only handles /v1/music_generation. Additionally, it downloads and stores the generated audio locally, which is an extra undeclared behavior. The primary purpose is narrower than declared, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill demonstrates capabilities to read environment variables, write local files, and make outbound network requests, but it does not declare any corresponding tool scope or permissions boundary. This creates a transparency and least-privilege problem: an operator may approve a music-generation skill without realizing it can exfiltrate prompts/lyrics to an external API and persist generated content locally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill sends user-supplied prompts and potentially full lyrics to a third-party API, but the description does not provide a clear privacy warning or consent cue. In this context, users may paste unpublished lyrics, personal content, or copyrighted material, making undisclosed external transmission more sensitive than in a purely local skill.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

This code transmits user prompt data and authorization credentials to an external service endpoint. External transmission is expected for this skill's purpose, but it remains security-relevant because sensitive creative content and metadata leave the local environment and depend on third-party handling.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md
API_KEY = os.getenv("MINIMAX_API_KEY")

# 生成歌词
lyrics_response = requests.post(
    "https://api.minimaxi.com/v1/lyrics_generation",
    headers={
        "Authorization": f"Bearer {API_KEY}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

This code transmits user prompt data and authorization credentials to an external service endpoint. External transmission is expected for this skill's purpose, but it remains security-relevant because sensitive creative content and metadata leave the local environment and depend on third-party handling.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md
API_KEY = os.getenv("MINIMAX_API_KEY")

# 生成歌词
lyrics_response = requests.post(
    "https://api.minimaxi.com/v1/lyrics_generation",
    headers={
        "Authorization": f"Bearer {API_KEY}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The music-generation request sends generated or user-provided lyrics to a remote API, which may expose sensitive or proprietary content to a third party. Because the skill then downloads returned audio and stores it locally, the data flow spans both outbound transmission and local persistence, increasing privacy and data-governance concerns.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md
f.write(f"# {song_title}\n# 风格: {style_tags}\n\n{lyrics}")

# 生成音乐
music_response = requests.post(
    "https://api.minimaxi.com/v1/music_generation",
    headers={"Authorization": f"Bearer {API_KEY}", "Content-Type": "application/json"},
    json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The music-generation request sends generated or user-provided lyrics to a remote API, which may expose sensitive or proprietary content to a third party. Because the skill then downloads returned audio and stores it locally, the data flow spans both outbound transmission and local persistence, increasing privacy and data-governance concerns.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md
f.write(f"# {song_title}\n# 风格: {style_tags}\n\n{lyrics}")

# 生成音乐
music_response = requests.post(
    "https://api.minimaxi.com/v1/music_generation",
    headers={"Authorization": f"Bearer {API_KEY}", "Content-Type": "application/json"},
    json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/lyrics-api.md (reported line 80)May include surrounding context.

md
API_KEY = os.getenv("MINIMAX_API_KEY")

response = requests.post(
    "https://api.minimaxi.com/v1/lyrics_generation",
    headers={
        "Authorization": f"Bearer {API_KEY}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/lyrics-api.md (reported line 101)May include surrounding context.

md
API_KEY = os.getenv("MINIMAX_API_KEY")

response = requests.post(
    "https://api.minimaxi.com/v1/lyrics_generation",
    headers={
        "Authorization": f"Bearer {API_KEY}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/lyrics-api.md (reported line 115)May include surrounding context.

md
API_KEY = os.getenv("MINIMAX_API_KEY")

response = requests.post(
    "https://api.minimaxi.com/v1/lyrics_generation",
    headers={
        "Authorization": f"Bearer {API_KEY}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/music-api.md (reported line 112)May include surrounding context.

md
API_KEY = os.getenv("MINIMAX_API_KEY")

response = requests.post(
    "https://api.minimaxi.com/v1/lyrics_generation",
    headers={
        "Authorization": f"Bearer {API_KEY}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/music-api.md (reported line 134)May include surrounding context.

md
API_KEY = os.getenv("MINIMAX_API_KEY")

response = requests.post(
    "https://api.minimaxi.com/v1/lyrics_generation",
    headers={
        "Authorization": f"Bearer {API_KEY}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/music-api.md (reported line 149)May include surrounding context.

md
API_KEY = os.getenv("MINIMAX_API_KEY")

response = requests.post(
    "https://api.minimaxi.com/v1/lyrics_generation",
    headers={
        "Authorization": f"Bearer {API_KEY}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/music-api.md (reported line 169)May include surrounding context.

md
API_KEY = os.getenv("MINIMAX_API_KEY")

response = requests.post(
    "https://api.minimaxi.com/v1/lyrics_generation",
    headers={
        "Authorization": f"Bearer {API_KEY}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/lyrics-api.md (reported line 80)May include surrounding context.

md
API_KEY = os.getenv("MINIMAX_API_KEY")

response = requests.post(
    "https://api.minimaxi.com/v1/lyrics_generation",
    headers={
        "Authorization": f"Bearer {API_KEY}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/lyrics-api.md (reported line 101)May include surrounding context.

示例 2: 续写歌词

python
response = requests.post(
    "https://api.minimaxi.com/v1/lyrics_generation",
    headers={"Authorization": f"Bearer {API_KEY}", "Content-Type": "application/json"},
    json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/lyrics-api.md (reported line 115)May include surrounding context.

示例 2: 续写歌词

python
response = requests.post(
    "https://api.minimaxi.com/v1/lyrics_generation",
    headers={"Authorization": f"Bearer {API_KEY}", "Content-Type": "application/json"},
    json={

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The reference shows sending prompts, lyrics, and optional reference audio to a third-party API, but it does not warn that potentially sensitive user content and uploaded audio leave the local system and are transmitted to MiniMax. In a skill context, users may assume their data stays within the assistant platform, so the omission can lead to inadvertent disclosure of private text, copyrighted lyrics, or personal voice/audio data.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/music-api.md (reported line 112)May include surrounding context.

md
API_KEY = os.getenv("MINIMAX_API_KEY")

response = requests.post(
    "https://api.minimaxi.com/v1/music_generation",
    headers={
        "Authorization": f"Bearer {API_KEY}",

Static analysis

No suspicious patterns detected.