minimax-cli-runtime
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documents the execution of the
mmxCLI tool via shell commands, specificallymmx text chat --message "<prompt>". This pattern introduces a potential command injection surface if the underlying runtime implementation does not properly escape characters like backticks or dollar signs within the prompt. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
mmx-clipackage from the NPM registry as a runtime dependency. This is documented as a standard setup procedure. - [PROMPT_INJECTION]: The skill performs operations like
ask,review, andadversarial-reviewwhich process untrusted external data (prompts and code diffs). This represents an indirect prompt injection surface. - Ingestion points: External text provided to the
askandreviewcommands. - Boundary markers: None identified in the provided documentation.
- Capability inventory: Shell command execution via the
mmxtool. - Sanitization: No specific sanitization or escaping mechanisms are described for the interpolated content.
Audit Metadata