recoup-minimax-music-3
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest a user-provided "brief" and pass it to a delegation tool to generate music captions. This interpolation of untrusted data into the generation pipeline represents a surface for indirect prompt injection.
- Ingestion points: User-provided music "briefs" in the delegation section of SKILL.md.
- Boundary markers: No explicit delimiters or boundary markers for the user input are described.
- Capability inventory: The skill utilizes network API calls via
fal.subscribeand command execution vianpx,ffprobe, andebur128. - Sanitization: No specific sanitization or validation of the input brief is mentioned before it is processed by the caption rewriter.
- [EXTERNAL_DOWNLOADS]: The skill recommends installing a utility via
npx skills add MiniMax-AI/MiniMax-Music3 --skill music-caption-rewriter. This fetches external configuration and code from the MiniMax-AI repository to assist with the song generation workflow. - [COMMAND_EXECUTION]: The skill instructions involve executing several commands:
npxfor adding sub-skills, andffprobeandebur128for validating the technical properties (duration, sample rate, and loudness) of the generated audio files.
Audit Metadata