music-composer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:08 AM UTC
• Version: 1.0.1

Overview

This music-generation skill matches its purpose, but it needs review because it installs and runs an external CLI with broad local file access and weak containment.

Install only if you trust the mmx CLI source and are comfortable sending prompts, lyrics, and reference audio to that tool or its service. Prefer an isolated environment, verify the executable path yourself, avoid private or sensitive audio/lyrics, and keep output names to simple filenames under the intended output folder.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Globally Installed Third-Party CLI Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15-19
Vulnerability Type: Supply-chain exposure through an unpinned globally installed executable
Risk Level: Medium

Vulnerable Code

bash

### Install mmx

# macOS / Linux
npm install -g @aivcore/mmx-cli

Technical Analysis

The installation instructions retrieve and globally install the latest available release of @aivcore/mmx-cli without pinning an audited version or verifying a package digest, signature, lockfile, or authenticated publisher identity.

A global npm installation exposes the user's environment to lifecycle scripts and executable files supplied by the package. The documentation refers users to the MiniMax website, but this alone does not cryptographically establish that the named npm namespace and downloaded package are controlled by MiniMax.

Because the installed mmx executable is subsequently trusted with prompts, lyrics, reference-audio paths, and output paths, a compromised package release, package-owner account, or namespace could turn the dependency into a local execution and data-access channel.

Attack Path

1. An attacker compromises the package publisher, package registry account, or an upstream dependency used by @aivcore/mmx-cli.
2. The attacker publishes a malicious version under the same package name.
3. A user follows the Skill instructions and runs the unversioned global installation command.
4. npm installs the malicious release and may execute its installation lifecycle scripts.
5. The installed mmx executable is later invoked by the Skill.
6. Malicious code executes with the installing or invoking user's privileges and can access content and files available to that user.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user who installs or runs the dependency. The malicious package could access prompts, lyrics, reference au ...[truncated 289 chars]

Remediation

View remediation

Remediation Suggestions

• Confirm and document the officially supported package name and authenticated publisher.
• Pin an exact audited version rather than installing the latest release implicitly.
• Verify a publisher signature or a trusted, published integrity digest before execution.
• Use a project-local dependency and lockfile instead of a global installation where practical.
• Install with lifecycle scripts disabled when compatible, and explicitly audit any required scripts.
• Execute the CLI in a restricted environment with access only to required input and output files.
• Publish supported checksums and a documented dependency-update review process.

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/generate_music.py:32

Finding

Unverified PATH-Resolved mmx Executable Is Invoked Automatically

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_music.py, lines 32-35 and 87-89
Vulnerability Type: Executable search-path spoofing
Risk Level: High

Vulnerable Code

python

def check_quota():
    print("📊 Checking mmx quota...")
    r = subprocess.run(["mmx", "quota"], capture_output=True, text=True)
    print(r.stdout or r.stderr)

python

if __name__ == "__main__":
    check_quota()
    if len(sys.argv) < 2:
        print(__doc__)
        sys.exit(0)

Generation commands are similarly constructed using the unqualified executable name:

python

cmd = [
    "mmx", "music", "generate",
    "--model", "music-2.6",
    "--prompt", prompt,
    "--instrumental",
    "--out", str(out_path)
]

Technical Analysis

The script invokes mmx by an unqualified name, causing the operating system to resolve the executable through the process environment's PATH. It does not verify the resolved path, publisher, signature, digest, ownership, or permissions before execution.

This contradicts the mandatory pre-execution check described in SKILL.md. More importantly, the script calls check_quota() before validating whether a supported mode or sufficient arguments were supplied. Consequently, merely starting the script executes whichever mmx binary appears first on PATH.

Although the subprocess calls correctly avoid shell=True, that protection only prevents shell metacharacter injection. It does not prevent executable substitution through search-path precedence. A self-reported version string would also be insufficient authentication because a spoofed executable can return the expected text.

Attack Path

1. An attacker places a malicious executable named mmx in a directory controlled by the attacker.
2. That directory is inserted before the legitimate installation directory in the victim process's PATH. This can occur through a manipulated ...[truncated 1010 chars]

Remediation

View remediation

Remediation Suggestions

• Validate command-line arguments before invoking any external executable.
• Resolve mmx from an explicitly configured absolute path rather than relying on PATH.
• Verify the executable using an authenticated publisher signature or a pinned cryptographic digest.
• Check that the executable and its parent directories are not writable by untrusted users.
• Reject unexpected executable locations and symbolic-link substitutions.
• Do not treat output from mmx --version as proof of authenticity; use it only as an additional compatibility check.
• Run the external CLI with least privilege and a minimal environment.
• Restrict filesystem and network access through sandboxing where supported.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_music.py:39

Finding

User-Controlled Output Name Can Escape the Intended Output Directory

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_music.py, lines 39-40, 55-56, and 74-75
Vulnerability Type: Path traversal and unrestricted output-path selection
Risk Level: Medium

Vulnerable Code

Instrumental output:

python

if not out_name:
    out_name = f"instrumental_{pd.ts()}.mp3"
out_path = DEFAULT_OUT_DIR / out_name

Song output:

python

if not out_name:
    out_name = f"song_{pd.ts()}.mp3"
out_path = DEFAULT_OUT_DIR / out_name

Cover output:

python

if not out_name:
    fname = Path(audio_file).stem
    out_name = f"cover_{fname}.mp3"
out_path = DEFAULT_OUT_DIR / out_name

The resulting path is passed to the external CLI:

python

"--out", str(out_path)

Technical Analysis

The optional output name comes directly from command-line arguments and is joined to DEFAULT_OUT_DIR without validation. Python's pathlib permits traversal components such as ..; joining an absolute path also causes the base directory to be discarded.

As a result, output names such as ../../target.mp3 or /tmp/target.mp3 can select locations outside the documented ~/video directory. The script then delegates creation or replacement of that path to mmx.

This is not shell-command injection because subprocess argument arrays are used. It is a filesystem destination-validation flaw whose final behavior depends on the external CLI's overwrite policy and the invoking user's operating-system permissions.

Attack Path

1. An attacker influences the output-name argument supplied to the helper.
2. The attacker supplies an absolute path or a relative name containing parent-directory traversal, such as ../../.config/target.
3. DEFAULT_OUT_DIR / out_name produces a path outside ~/video.
4. The path is passed to mmx through the --out option.
5. If the destination is writable and the CLI creates or replaces it, generated content is writte ...[truncated 550 chars]

Remediation

View remediation

Remediation Suggestions

• Restrict out_name to a filename rather than accepting a path.
• Reject absolute paths, .. components, directory separators, and unexpected extensions.
• Resolve the candidate destination and verify that it remains beneath the resolved output directory.
• Use a conservative allowlist such as letters, digits, underscores, hyphens, and a required .mp3 extension.
• Create DEFAULT_OUT_DIR with controlled permissions before generation.
• Refuse to overwrite an existing file unless the user explicitly authorizes replacement.
• Where possible, create the destination securely and ensure that symbolic links cannot redirect the write.
• Apply the same centralized validation routine to instrumental, song, and cover modes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The code is clearly related to music generation via mmx-cli, so the general domain matches the description. It supports instrumental generation, song generation with lyrics, and cover creation, which aligns partially with the declared purpose. However, the description emphasizes a higher-level planning skill that automatically structures musical attributes and refines fuzzy requests into precise prompts. The actual code does not implement any such planning or prompt-construction logic; it is only a thin CLI wrapper that forwards user-supplied prompts and files to mmx. Additionally, the code reads lyrics from disk and writes output files locally, behaviors not reflected in the declared description. Therefore the description overstates and inaccurately represents the code's actual behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill invokes shell commands (which mmx, mmx --version, mmx music generate, mmx music cover) and references local file paths, but it does not declare any permissions or allowed-tools scope. This creates a governance and least-privilege gap: an orchestrator may permit broader tool use than intended, and users are not clearly informed that shell and file access are required.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger description is very broad, covering many common music-related requests, which increases the chance that the skill is invoked in contexts where shell execution and local file output are unnecessary or unexpected. Over-broad activation can expand the attack surface by causing this skill to run when a safer, non-executing planning-only response would have been sufficient.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The command templates require '<英文 Prompt>', and the planning section later treats English prompt composition as the standard format without offering a language choice. This is a natural-language locale policy concern because the skill serves Chinese and English song use cases but forces one prompt language rather than asking for or documenting user preference.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate_music.py (reported line 20)May include surrounding context.

python

def run(cmd):
    print(f"\n🎵 Executing: {' '.join(cmd)}")
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.stdout:
        print(result.stdout)
    if result.stderr:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate_music.py (reported line 31)May include surrounding context.

python

def check_quota():
    print("📊 Checking mmx quota...")
    r = subprocess.run(["mmx", "quota"], capture_output=True, text=True)
    print(r.stdout or r.stderr)

def generate_instrumental(prompt, out_name=None):

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The function reads the full lyrics file and submits its contents to the external mmx CLI, which may forward that data to a remote service. If users provide unpublished lyrics, sensitive text, or regulated content, the tool transmits it without any explicit notice, consent step, or minimization, creating a privacy and confidentiality risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The cover-generation path submits a user-supplied audio file to the external mmx command without an explicit privacy disclosure. Audio can contain copyrighted, private, biometric, or otherwise sensitive material, so silent transmission to a third-party service can expose users to confidentiality, compliance, and IP risks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The section on vocal prompt keywords presents Chinese headings and context, but several prompt values are fixed in English, and one template section is explicitly for English lyrics. This can amount to a language/locale policy issue because the file implicitly steers users toward English phrasing without stating that language selection is optional or justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown reference is primarily written in Chinese, with section headings, descriptions, and labels assuming Chinese as the default user language. Under the policy, language-specific content should either offer user choice or clearly justify the locale restriction; neither is stated here.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.