MiniMax TTS 国内版

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 1:18 AM UTC
• Version: 1.0.0

Overview

It does what it says: sends your chosen text to MiniMax to create an audio file, so only use it with text you are comfortable sharing with MiniMax.

Install only if you are comfortable sending synthesis text to MiniMax and exposing MINIMAX_API_KEY to this script. Avoid passing secrets, private documents, or sensitive personal data as TTS input; for production use, pin dependencies and fix the front-matter indentation so install metadata parses reliably.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8

Finding

Unpinned Third-Party Python Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8-11
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

The Skill declares the requests package without a version constraint or integrity hash:

yaml

    requires:
      bins: [python3]
      env: [MINIMAX_API_KEY]
      pip: [requests]

Technical Analysis

Dependency resolution is not reproducible because the package requirement does not specify an reviewed version or expected artifact hash. An installation performed at a later date may therefore retrieve a different release from the configured Python package index.

The dependency name is legitimate and there is no evidence that the current package is malicious. However, if the package distribution, package index, maintainer account, or dependency-resolution environment were compromised, the installer could retrieve attacker-controlled code. Python packages can execute code during installation or when imported by scripts/tts.py, potentially exposing the MINIMAX_API_KEY and any other data accessible to the process.

Attack Path

1. An attacker compromises the package distribution channel, a relevant maintainer account, or the package index used by the deployment environment.
2. The attacker publishes or substitutes a malicious package artifact that satisfies the unconstrained requests requirement.
3. The Skill installation process resolves and installs that mutable artifact because no version or integrity hash is enforced.
4. Malicious code runs during package installation or when scripts/tts.py imports requests.
5. The code gains the privileges of the installer or Skill process and may access environment variables, local files available to that account, and network resources.

Impact Assessment

Successful exploitation could permit arbitrary Python code execution with the privileges of the account installing or running the Skill. Accessible data could ...[truncated 296 chars]

Remediation

View remediation

Remediation Suggestions

• Pin requests to a specific reviewed version rather than using an unconstrained package name.
• Maintain dependencies in a lock file that records all transitive dependency versions.
• Enforce artifact integrity with cryptographic hashes, such as pip's --require-hashes workflow.
• Install packages only from an explicitly configured and trusted package index.
• Use a dedicated virtual environment and run installation and execution as an unprivileged account.
• Add automated dependency scanning and a controlled update process so pinned versions continue to receive security patches.
• Avoid exposing unrelated secrets to the Skill process; provide only MINIMAX_API_KEY and other variables strictly required for operation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The description states the skill is for generating '高质量中文语音' (high-quality Chinese speech), which imposes a specific language context in the natural-language description. Although later lines list English voices, the primary description does not offer a user choice or explain a justified locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The top-level description and all user-facing help/error/output strings are written in Chinese, which effectively forces a specific language for interaction. The file does not offer an opt-in language choice or explain that the tool is intentionally limited to a Chinese-speaking context.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/tts.py (reported line 36)May include surrounding context.

python

data = {"voice_type": "all"}
    
    try:
        resp = requests.post(url, headers=headers, json=data, timeout=30)
        resp.raise_for_status()
        result = resp.json()

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

The script transmits arbitrary user-provided text to a third-party TTS service, which can expose sensitive content if users pass secrets, personal data, or internal material for synthesis. In the context of an agent skill, this is more dangerous because upstream tools or workflows may automatically feed unreviewed data into the script, causing unintended external disclosure.

Content

Scanner excerpt · scripts/tts.py (reported line 96)May include surrounding context.

python

try:
        print(f"正在生成语音...", file=sys.stderr)
        resp = requests.post(url, headers=headers, json=data, timeout=60)
        resp.raise_for_status()
        result = resp.json()

Static analysis

No suspicious patterns detected.