recoup-minimax-music-3

Pass

Audited by Gen Agent Trust Hub on Oct 10, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest a user-provided "brief" and pass it to a delegation tool to generate music captions. This interpolation of untrusted data into the generation pipeline represents a surface for indirect prompt injection.
  • Ingestion points: User-provided music "briefs" in the delegation section of SKILL.md.
  • Boundary markers: No explicit delimiters or boundary markers for the user input are described.
  • Capability inventory: The skill utilizes network API calls via fal.subscribe and command execution via npx, ffprobe, and ebur128.
  • Sanitization: No specific sanitization or validation of the input brief is mentioned before it is processed by the caption rewriter.
  • [EXTERNAL_DOWNLOADS]: The skill recommends installing a utility via npx skills add MiniMax-AI/MiniMax-Music3 --skill music-caption-rewriter. This fetches external configuration and code from the MiniMax-AI repository to assist with the song generation workflow.
  • [COMMAND_EXECUTION]: The skill instructions involve executing several commands: npx for adding sub-skills, and ffprobe and ebur128 for validating the technical properties (duration, sample rate, and loudness) of the generated audio files.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 10, 2026, 02:15 PM