minimax-multimodal-toolkit
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The toolkit uses curl to download generated media assets from legitimate MiniMax API hosts (api.minimaxi.com and api.minimax.io). These downloads are restricted to content produced by the AI models and are saved to a user-defined output directory.
- [COMMAND_EXECUTION]: The toolkit leverages common command-line utilities including ffmpeg, ffprobe, jq, and xxd to process media files and decode API responses. Commands are executed using safe bash practices, such as array-based argument handling and variable quoting, to prevent shell injection vulnerabilities.
- [INDIRECT_PROMPT_INJECTION]: As a multimodal generation tool, the skill processes user-supplied text and media as inputs for external AI models. The scripts use jq to build JSON payloads, ensuring that user input is correctly escaped and does not interfere with the API request structure.
- [CREDENTIALS_SAFE]: The skill manages MiniMax API keys through environment variables or local .env files, which is the standard industry practice for development tools. It includes a check script to verify credentials without exposing them in logs or output.
Audit Metadata