mmx-cli
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on the execution of the
mmxcommand-line utility for all core functions, including text, image, video, and speech generation. - [EXTERNAL_DOWNLOADS]: Instructions provide for the installation of the
mmx-clipackage via the NPM registry. - [DATA_EXFILTRATION]: The skill accesses local files (images, audio, video) to upload them to the MiniMax AI platform and manages credentials within the
~/.mmx/directory. The instructions explicitly mandate secure credential handling, such as using environment variables and local config files, to prevent leaking keys in shell history or logs. - [INDIRECT_PROMPT_INJECTION]: The agent processes untrusted data from external sources including web search results, VLM image descriptions, and audio transcriptions.
- Ingestion points: Data returned by
mmx speech transcribe,mmx vision describe, andmmx search queryis processed by the agent. - Boundary markers: No specific delimiters are mandated in the skill instructions for these data types.
- Capability inventory: The agent has the ability to execute shell commands and read/write local files.
- Sanitization: The instructions do not specify explicit sanitization or validation logic for the content retrieved from external tools.
Audit Metadata