MiniMax Speech 2.8

• Outcome: Pass
• Latest audit: May 28, 2026 at 11:13 AM UTC
• Version:
  1.0.0

Overview

This is a straightforward MiniMax text-to-speech helper with expected API-key, network, and file-output behavior, but users should avoid untrusted endpoints and choose output paths carefully.

Install only if you are comfortable using a MiniMax API key and sending TTS text to MiniMax. Use the default or verified MiniMax regional endpoints only, avoid confidential text unless MiniMax's terms are acceptable, install `requests` from a trusted source, and choose output paths deliberately because the script can write or overwrite the path you provide.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documentation describes capabilities to read an API key from the environment, write output files, and send network requests, but the skill declares no permissions. This mismatch can bypass user/operator expectations and reduce security review visibility, especially because the skill transmits data to a third-party API and saves returned content locally.

VirusTotal

66/66 vendors flagged this skill as clean.