Skip to content
skillsafebeta
← Report library
Purpose / Writing

Mmx Cli Skill Security Audit

What the author says it does (original text)

Use mmx to generate text, images, video, and speech via the MiniMax AI platform. Use when the user wants to create media content, chat with MiniMax models, perform web search, or manage MiniMax API resources from the terminal.

Independent security check

Do not install or run it yet

Files checked
3
Risks found
4
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
High risk

Prerequisite globally installs an unpinned npm package

Source references: 1
What we found

The guide directly runs `npm install -g mmx-cli` without pinning a version, checking a hash, or verifying the package source. A global npm install trusts whichever package the registry resolves at that time and may run installation lifecycle code. The supplied material does not contain the package implementation, so its behavior cannot be verified here.

Why this matters

If the package name, publisher account, or a future release is compromised, installation could execute code with the current user's permissions and leave a persistent global `mmx` executable.

This is an active global-install instruction, not a warning or test. It neither pins a version nor verifies package integrity, so execution trusts whatever `mmx-cli` npm resolves at that time and may run its install scripts. The package implementation is not provided for further review. A user can ask for a pinned, integrity-verified version or inspect it in an isolated environment first.

SKILL.md:12In the instructionsOpen original file
```bash# Installnpm install -g mmx-cli# Auth (OAuth persists to ~/.mmx/credentials.json, API key persists to ~/.mmx/config.json)mmx auth login --api-key sk-xxxxx
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Chats and local media can be sent to MiniMax

Source references: 5
What we found

Text commands can read a message JSON file or stdin, while speech, vision, and H3 video commands can read local files. The reference explicitly states that local media is Base64-encoded into the request, so selecting a path transfers that file's content to the external service for processing.

Why this matters

Selected conversations, images, audio, or videos may contain personal information, customer data, location details, or unreleased material and become subject to MiniMax storage, logging, regional-processing, and retention policies. Public URLs further widen asset accessibility.

The skill processes content through MiniMax. Chat can read a selected JSON file or stdin, vision reads and encodes a local image, and the H3 guide explicitly says local media is Base64-encoded into the request. Thus, user-selected messages or media are sent to an external service and could contain unintended sensitive data. Users can restrict accessible paths and confirm each file before submission.

SKILL.md:57In the instructionsOpen original file
|---|---|---|| `--message <text>` | string, **required**, repeatable | Message text. Prefix with `role:` to set role (e.g. `"system:You are helpful"`, `"user:Hello"`) || `--messages-file <path>` | string | JSON file with messages array. Use `-` for stdin || `--system <text>` | string | System prompt || `--model <model>` | string | Model ID (default: `MiniMax-M3`) |
Show 4 other places
SKILL.md:178In the instructionsOpen original file
|---|---|---|| `--text <text>` | string | Text to synthesize || `--text-file <path>` | string | Read text from file. Use `-` for stdin || `--model <model>` | string | `speech-2.8-hd` (default), `speech-2.6`, `speech-02` |
SKILL.md:218In the instructionsOpen original file
|---|---|---|| `--image <path-or-url>` | string | Local path or URL (auto base64-encoded) || `--file-id <id>` | string | Pre-uploaded file ID (skips base64) || `--prompt <text>` | string | Question about the image (default: `"Describe the image."`) |
h3-video/references/h3-video.md:164In the instructionsOpen original file
The total number of reference images, videos, and audios in a mixed-reference request must not exceed 12. Local media is Base64-encoded, and MMX limits the complete request body to 64 MB. Use public URLs or `mm_file://<file-id>` for large or numerous media inputs.
SKILL.md:8In the instructionsOpen original file
Use `mmx` to generate text, images, video, speech, and perform web search via the MiniMax AI platform.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

H3 workflow persists a runtime API key and replaces existing authentication state

Source references: 2
What we found

When `MINIMAX_API_KEY` exists at runtime, the guide instructs saving it to `~/.mmx/config.json`. It also states that this replaces stale OAuth credentials and clears the cached region. Owner-only permissions reduce access by other local accounts, but the secret still becomes a long-lived disk credential.

Why this matters

A temporarily injected secret becomes persistent, and later commands may charge that account without the user realizing which credential is active. Replacing OAuth and region state may also change the account or region used by other MMX workflows.

When a user-provided `MINIMAX_API_KEY` is securely present in the runtime, the workflow persists it to MMX configuration. Although the document says the file has owner-only permissions, it also says saving the key removes stale OAuth credentials and clears the cached region. This changes persistent authentication state rather than only the current call. Users can require ephemeral environment use or approve replacement of the existing login first.

h3-video/SKILL.md:45In the instructionsOpen original file
- If `method` is `api-key`, reuse it from MMX config. Do not add `--api-key` to generation commands.- If the user already supplied a key and the runtime holds it securely as `MINIMAX_API_KEY`, save it once, then use MMX config:```bashmmx config set --key api_key --value "$MINIMAX_API_KEY" --quiet```
Show 1 other places
h3-video/SKILL.md:52In the instructionsOpen original file
- Saving `api_key` replaces stale OAuth credentials, clears the cached region, and stores the key in `~/.mmx/config.json` with owner-only permissions.- Never reconstruct a previously supplied key into visible shell text. Use the runtime's secret/environment injection when available.- If no saved API key or securely injected variable is available, ask the user to run `mmx auth login` and choose API key. Do not ask them to paste the key into chat again.- After saving, future Agent commands must omit both the literal key and `--api-key`.
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

H3 generation directly creates a paid task without a separate price-confirmation step

Source references: 5
What we found

The guide explicitly calls H3 requests paid and directs the agent to submit, wait for, and download a task through one `video generate` command. Although duration is supplied, the provided instructions do not query price, set a spending cap, or require a separate cost confirmation before submission.

Why this matters

Executing the request may immediately incur charges on the selected account. Duplicate-task safeguards are present, but the price and balance effect of the first task can occur before the user sees a result.

The guide explicitly calls H3 calls “paid requests” and directs one blocking generation command that submits a task. It specifies duration and other parameters but does not show a price, budget cap, or cost confirmation before the initial submission. A request to generate a video may authorize the operation, but not necessarily demonstrate awareness of its cost. Repeat paid submissions do require approval after failure. Users can require an estimate and explicit confirmation before the first task.

h3-video/SKILL.md:10In the instructionsOpen original file
Before a paid request, read `references/h3-video.md` for prompt construction, media constraints, waiting behavior, and failure handling.
Show 4 other places
h3-video/SKILL.md:61In the instructionsOpen original file
```bashmmx video generate \  --model MiniMax-H3 \  --prompt "<video prompt>" \  --duration <4-15> \  --download <output.mp4> \  --poll-interval 10 \  --timeout 1800 \  --non-interactive```
h3-video/SKILL.md:72In the instructionsOpen original file
This one CLI process submits exactly one task, waits internally between status checks, and downloads the completed video. When the execution tool returns a running session or cell ID, continue waiting on that same session until it exits.Do not add `--async` to this command. Async mode returns before download handling.
h3-video/SKILL.md:17In the instructionsOpen original file
3. Always pass `--model MiniMax-H3`; never rely on the configured default model.4. For a completed video, run one direct blocking `mmx video generate` command. Do not use Bash wrappers or hand-written polling loops.5. If the terminal command remains active, wait on that exact execution session. Do not run `ps`, scrape process arguments, inspect the output repeatedly, kill the process, or submit another task.
h3-video/SKILL.md:217In the instructionsOpen original file
- A running terminal session: keep waiting on the same session; absence of a final path is not failure.- Terminal task status `failed`, `cancelled`, or `expired`: report the status and task error; require approval before another paid submission.- Polling timeout: report the task ID when available; do not submit a duplicate.

Inside this skill

7 instruction sections

This Skill is a CLI guide for MiniMax text, image, video, speech, vision, and web-search services. These operations depend on the external MiniMax service rather than processing everything locally.

View source
SKILL.md:3In the instructionsOpen original file
name: mmx-clidescription: Use mmx to generate text, images, video, and speech via the MiniMax AI platform. Use when the user wants to create media content, chat with MiniMax models, perform web search, or manage MiniMax API resources from the terminal.---
SKILL.md:8In the instructionsOpen original file
Use `mmx` to generate text, images, video, speech, and perform web search via the MiniMax AI platform.

The H3 workflow explicitly creates paid tasks and uses one blocking command to wait for and download the result. Async mode is reserved for cases where the user explicitly requests a task ID.

View source
h3-video/SKILL.md:17In the instructionsOpen original file
3. Always pass `--model MiniMax-H3`; never rely on the configured default model.4. For a completed video, run one direct blocking `mmx video generate` command. Do not use Bash wrappers or hand-written polling loops.5. If the terminal command remains active, wait on that exact execution session. Do not run `ps`, scrape process arguments, inspect the output repeatedly, kill the process, or submit another task.
h3-video/SKILL.md:22In the instructionsOpen original file
8. Retry the alternate region at most once, and only when the first command clearly failed before task creation because of region detection, endpoint, or authentication routing.9. Use `--async` only when the user explicitly wants a task ID without waiting or downloading.
h3-video/SKILL.md:72In the instructionsOpen original file
This one CLI process submits exactly one task, waits internally between status checks, and downloads the completed video. When the execution tool returns a running session or cell ID, continue waiting on that same session until it exits.

The H3 guide includes duplicate-charge safeguards: once a task may exist, polling, terminal, or download failures must not trigger regeneration, and another paid submission after terminal failure requires user approval.

View source
h3-video/SKILL.md:20In the instructionsOpen original file
6. Treat `Detecting region... cn` or `Detecting region... global` as normal stderr progress, not a submission failure.7. Never submit a replacement paid task because terminal waiting, status polling, or downloading was interrupted.8. Retry the alternate region at most once, and only when the first command clearly failed before task creation because of region detection, endpoint, or authentication routing.9. Use `--async` only when the user explicitly wants a task ID without waiting or downloading.
h3-video/SKILL.md:217In the instructionsOpen original file
- A running terminal session: keep waiting on the same session; absence of a final path is not failure.- Terminal task status `failed`, `cancelled`, or `expired`: report the status and task error; require approval before another paid submission.- Polling timeout: report the task ID when available; do not submit a duplicate.- Download failure after success: retry the same result download only; never regenerate the video.

The guide requires size and format preflight for local media, but states that local media is Base64-encoded into the request; larger or numerous assets are directed to public URLs or pre-uploaded file IDs.

View source
h3-video/references/h3-video.md:164In the instructionsOpen original file
The total number of reference images, videos, and audios in a mixed-reference request must not exceed 12. Local media is Base64-encoded, and MMX limits the complete request body to 64 MB. Use public URLs or `mm_file://<file-id>` for large or numerous media inputs.Before a paid request, inspect local video/audio duration and codec once when they are unknown. Do not transcode media unless it violates an actual format or duration rule.
Start here · InstructionsSKILL.md
mmx-cli
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 2
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records3 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • h3-video/SKILL.mdFull text included
  • h3-video/references/h3-video.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • h3-video/SKILL.mdSupporting file
  • h3-video/references/h3-video.mdSupporting file

Operations mentioned in code and instructions

Run commands
SKILL.md:12In the instructionsOpen original file
```bash# Install
SKILL.md:51In the instructionsOpen original file
```bashmmx text chat --message <text> [flags]
SKILL.md:67In the instructionsOpen original file
```bash# Single message
Install extra software packages
SKILL.md:14In the instructionsOpen original file
# Installnpm install -g mmx-cli
Read keys or account settings
SKILL.md:16In the instructionsOpen original file
# Auth (OAuth persists to ~/.mmx/credentials.json, API key persists to ~/.mmx/config.json)mmx auth login --api-key sk-xxxxx
SKILL.md:17In the instructionsOpen original file
# Auth (OAuth persists to ~/.mmx/credentials.json, API key persists to ~/.mmx/config.json)mmx auth login --api-key sk-xxxxx
SKILL.md:23In the instructionsOpen original file
# Or pass per-callmmx text chat --api-key sk-xxxxx --message "Hello"```
Read files
SKILL.md:78In the instructionsOpen original file
# From filecat conversation.json | mmx text chat --messages-file - --output json```
SKILL.md:109In the instructionsOpen original file
```bashmmx image generate --prompt "A cat in a spacesuit" --output json --quiet# stdout: image URLs (one per line in quiet mode)
SKILL.md:179In the instructionsOpen original file
| `--text <text>` | string | Text to synthesize || `--text-file <path>` | string | Read text from file. Use `-` for stdin || `--model <model>` | string | `speech-2.8-hd` (default), `speech-2.6`, `speech-02` |
Lines read
752
File checksum (to compare versions)
370130cb308bbb61419bc8344206fa6183d2a2efe112affabbfc0098f982efa2