The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires the installation of the mmx-cli package via npm (npm install -g mmx-cli). This is a standard installation of a third-party utility from a public registry.
[COMMAND_EXECUTION]: The skill's primary function is to execute shell commands using the mmx binary. This includes capabilities for file system writes (--out, --out-dir) and network requests to the MiniMax API.
[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection. It ingests untrusted user data (e.g., through --message, --prompt, or --text flags) and interpolates it directly into shell commands. There are no boundary markers or sanitization instructions provided to the agent to prevent malicious content from manipulating the command-line execution or the model's behavior.
Ingestion points: User-provided strings for messages, image/video prompts, and speech text in SKILL.md.
Boundary markers: Absent. No delimiters or warnings are used when passing user input to the CLI.
Capability inventory: The skill performs network operations (API calls) and file system operations (saving generated media) across multiple commands.
Sanitization: Absent. The skill does not instruct the agent to escape or validate user input before shell interpolation.

mmx-cli