minimax-voice-director

Pass

Audited by Gen Agent Trust Hub on Aug 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: Multiple scripts within the skill (finalize_segments.py, publish_voice.py, validate_voiceover.py) utilize subprocess.run to invoke ffmpeg and ffprobe for audio encoding, tempo adjustment, and silence detection. These calls are implemented with strict argument handling and validation.
  • [EXTERNAL_DOWNLOADS]: The assets/minimax_tts.py module performs network requests to api.minimax.io to transmit text and download generated audio files. This is the primary intended function of the skill and uses official API endpoints.
  • [DATA_INTEGRITY]: The skill implements a sophisticated integrity management system in direction_contract.py that uses SHA-256 hashing to link approvals to specific versions of the direction YAML and source scripts, preventing unauthorized modifications during the production pipeline.
  • [PATH_TRAVERSAL_PROTECTION]: The publish_voice.py utility includes a reject_symlink_components function that performs a secure path walk to ensure that file publication operations cannot be redirected via symbolic links and are confined to the designated project root.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided scripts (script.md) to generate voiceover content. The risk of injection is mitigated by a mandatory 'human-in-the-loop' approval process and structured YAML validation that strips engine-specific tags from intermediate layers.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 13, 2026, 02:52 PM
Security Audit — agent-trust-hub — minimax-voice-director