minimax-music-gen
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes various shell commands to interact with the mmx CLI for music generation, covers, and quota checks. It also utilizes local media players such as mpv, ffplay, and afplay to play the generated audio files.
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install the mmx-cli package globally via npm to enable the core music generation functionality.
- [INDIRECT_PROMPT_INJECTION]: The skill acts as an ingestion surface for untrusted data by taking user-provided lyrics and music descriptions and interpolating them into shell command arguments.
- Ingestion points: User-supplied text for lyrics and style descriptions in Step 1 and Step 2 of the workflow.
- Boundary markers: The instructions recommend wrapping user inputs in double quotes within the CLI commands (e.g., --prompt "").
- Capability inventory: The skill has the ability to execute CLI commands and write mp3 files to the user's local Music directory.
- Sanitization: No explicit sanitization or character escaping logic is defined for the user-supplied strings before they are executed in the shell environment.
Audit Metadata