skills/minimax-ai/cli/mmx-cli/Gen Agent Trust Hub

mmx-cli

Pass

Audited by Gen Agent Trust Hub on Oct 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill relies on the execution of the mmx command-line utility for all core functions, including text, image, video, and speech generation.
  • [EXTERNAL_DOWNLOADS]: Instructions provide for the installation of the mmx-cli package via the NPM registry.
  • [DATA_EXFILTRATION]: The skill accesses local files (images, audio, video) to upload them to the MiniMax AI platform and manages credentials within the ~/.mmx/ directory. The instructions explicitly mandate secure credential handling, such as using environment variables and local config files, to prevent leaking keys in shell history or logs.
  • [INDIRECT_PROMPT_INJECTION]: The agent processes untrusted data from external sources including web search results, VLM image descriptions, and audio transcriptions.
  • Ingestion points: Data returned by mmx speech transcribe, mmx vision describe, and mmx search query is processed by the agent.
  • Boundary markers: No specific delimiters are mandated in the skill instructions for these data types.
  • Capability inventory: The agent has the ability to execute shell commands and read/write local files.
  • Sanitization: The instructions do not specify explicit sanitization or validation logic for the content retrieved from external tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 12, 2026, 07:47 PM