Back to skill
Skillv1.0.1
ClawScan security
music-composer · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
SuspiciousApr 16, 2026, 9:39 AM
- Verdict
- suspicious
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's behavior (it runs the external 'mmx' CLI and includes a helper script) matches its music-generation description, but the package metadata omits the required mmx binary and provides no homepage/source — that mismatch and the unverified npm install recommendation are concerning.
- Guidance
- Before installing or running this skill: - Verify the mmx CLI: the skill depends on an external tool named 'mmx' but the registry metadata does not declare it. Confirm the official project/homepage (the SKILL.md mentions https://www.minimax.io — check that domain and the npm package @aivcore/mmx-cli match the official project). - Prefer sandboxed testing: if you must 'npm install -g', consider installing in a container or VM first to observe behavior (global npm installs can run arbitrary scripts). - Validate the npm package and author: review the @aivcore/mmx-cli package, its maintainers, and its GitHub/release tags before trusting it. - Check what 'mmx' does: the included code will call 'mmx quota' and 'mmx music generate/cover' — confirm that the mmx CLI does not upload local files or telemetry you don't expect. - Be cautious with file contents: the script reads lyric files you provide and writes outputs to ~/video; avoid putting sensitive data in inputs. - If you need higher assurance, ask the publisher for the official homepage/source or request that the registry metadata be updated to declare 'mmx' as a required binary and include a verified upstream URL. Overall: the skill appears functionally coherent but metadata omissions and an unverified npm install recommendation justify caution.
Review Dimensions
- Purpose & Capability
- concernSKILL.md and the included script both require an external 'mmx' CLI (and even recommend installing @aivcore/mmx-cli via npm). However, the skill's registry metadata lists no required binaries, no homepage, and no source. That omission is inconsistent: a music-generation skill legitimately needs mmx, so the metadata should declare it and provide a trusted source. The missing homepage/source makes it harder to verify the claimed upstream project.
- Instruction Scope
- noteThe runtime instructions and the script stay within the stated purpose: they run mmx commands, build prompts, read a user-supplied lyrics file, and write output files to ~/video. The SKILL.md explicitly advises verifying the mmx binary before running commands. The skill does not request unrelated system files or environment variables, nor does it attempt to exfiltrate data to external endpoints in the provided files.
- Install Mechanism
- noteThere is no formal install spec in the registry (instruction-only), but SKILL.md suggests installing mmx via npm ('npm install -g @aivcore/mmx-cli'). Because the skill has no homepage/source and the npm package namespace is not independently verified here, recommending a global npm install is a moderate-risk instruction — users should confirm the package's official origin and consider installing in a sandbox or container.
- Credentials
- okThe skill requests no environment variables, credentials, or config paths. The script only uses the user's home directory for output and reads a provided lyrics file; there is no access to unrelated secrets or system configuration in the included code.
- Persistence & Privilege
- okThe skill does not request 'always' presence and does not modify other skills or system-wide settings. It runs on-demand and uses external mmx CLI; autonomy settings are default and appropriate for this kind of integration.