minimax-multimodal-toolkit
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
mmx-clipackage via NPM (npm install -g mmx-cli). This is the official command-line interface for the MiniMax platform and is considered a standard developer tool installation. - [REMOTE_CODE_EXECUTION]: While the skill uses external tools to generate content, it does not involve executing arbitrary remote scripts or piping external URLs into a shell. The primary function is to call a verified CLI utility.
- [CREDENTIALS_UNSAFE]: The documentation provides examples of authentication using placeholders like
sk-xxxxx. It correctly advises users to persist credentials in~/.mmx/credentials.jsonor use environment variables (MINIMAX_API_KEY), which are standard and safe practices for managing API keys. - [DATA_EXFILTRATION]: The skill facilitates data movement to and from the MiniMax AI platform (e.g., uploading images for description or downloading generated videos). These are documented core features of the service and target the platform's official API endpoints.
- [INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface for indirect prompt injection as it can ingest untrusted data (e.g., reading messages from files or standard input using
--messages-file -). However, this is a common characteristic of LLM interaction tools and is mitigated by the platform's own content filters (exit code 10).
Audit Metadata