minimax-voice-director
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: Multiple scripts within the skill (
finalize_segments.py,publish_voice.py,validate_voiceover.py) utilizesubprocess.runto invokeffmpegandffprobefor audio encoding, tempo adjustment, and silence detection. These calls are implemented with strict argument handling and validation. - [EXTERNAL_DOWNLOADS]: The
assets/minimax_tts.pymodule performs network requests toapi.minimax.ioto transmit text and download generated audio files. This is the primary intended function of the skill and uses official API endpoints. - [DATA_INTEGRITY]: The skill implements a sophisticated integrity management system in
direction_contract.pythat uses SHA-256 hashing to link approvals to specific versions of the direction YAML and source scripts, preventing unauthorized modifications during the production pipeline. - [PATH_TRAVERSAL_PROTECTION]: The
publish_voice.pyutility includes areject_symlink_componentsfunction that performs a secure path walk to ensure that file publication operations cannot be redirected via symbolic links and are confined to the designated project root. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided scripts (
script.md) to generate voiceover content. The risk of injection is mitigated by a mandatory 'human-in-the-loop' approval process and structured YAML validation that strips engine-specific tags from intermediate layers.
Audit Metadata