Skills frontend-dev

📦

frontend-dev

Name: frontend-dev
Author: MiniMax-AI

v1.0.0 Content revision r2 High Risk ⚙️ External commands🔑 Env variables📁 Filesystem access🌐 Network access⚡ Contains scripts

Build Polished Frontend Experiences

Frontend projects often need coordinated design, motion, media, and copy. This skill provides one workflow for building and refining complete experiences.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "frontend-dev" from https://skillstore.io/skills/minimax-ai-frontend-dev.md and its manifest at https://skillstore.io/api/skills/minimax-ai-frontend-dev/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/minimax-ai-frontend-dev.md Signed manifest GET /api/skills/minimax-ai-frontend-dev/manifest Signed lockfile GET /api/skills/minimax-ai-frontend-dev/lockfile

Test it

Using "frontend-dev". Build a launch page for a privacy-focused team calendar.

Expected outcome:

A responsive product page with clear scheduling benefits, trust-focused proof, pricing, FAQ, loading states, and subtle section reveals.

Using "frontend-dev". Create an animated portfolio for a motion designer.

Expected outcome:

An asymmetric portfolio layout with project media and focused case-study copy.
Reduced-motion alternatives, lazy-loaded animation tools, and mobile interaction adjustments.
Locally stored visual assets with descriptive filenames.

Using "frontend-dev". Design interactive generative artwork for a music event.

Expected outcome:

A self-contained p5.js experience with seeded variations, event controls, responsive rendering, and a matching visual philosophy.

Security Audit

High Risk

v7 • 8/9/2026 Open versioned report

Most static alerts are false positives from Markdown, license text, normal media writes, and documented MiniMax API access. Confirmed risks include terminal key disclosure, unrestricted lyrics-file upload, and bearer credentials sent to an unvalidated API base.

Files scanned

6,382

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

scripts/minimax_music.py:113-125 scripts/minimax_music.py:64-69

Arbitrary Local File Sent as Lyrics

The music CLI reads any --lyrics-file path and submits its contents to MiniMax, which can expose unrelated local files.

The CLI accepts an unrestricted path, reads it verbatim, and includes the resulting lyrics in the external API request.

High

scripts/minimax_image.py:20-34 scripts/minimax_music.py:21-24 scripts/minimax_music.py:64-69 scripts/minimax_tts.py:21-24 scripts/minimax_tts.py:66-69 scripts/minimax_video.py:21-33

Bearer Credential Sent to Configurable Endpoint

Each script accepts any MINIMAX_API_BASE value and sends MINIMAX_API_KEY as a bearer token, enabling credential disclosure to a misconfigured endpoint.

The destination is fully environment-controlled while authorization headers always contain the API key. No scheme or hostname validation is present.

Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

references/troubleshooting.md:22

Generic API/secret keys

echo $MINIMAX_API_KEY

The troubleshooting command prints the full API key to the terminal, where logs or transcripts may retain it. Key presence should be checked without revealing its value.

Risk Factors

⚙️ External commands (50)

references/env-setup.md:18 references/motion-recipes.md:278-293 references/motion-recipes.md:355-368 references/motion-recipes.md:368-378 references/troubleshooting.md:32 scripts/minimax_music.py:5 scripts/minimax_tts.py:5 SKILL.md:33-35 SKILL.md:35-41 SKILL.md:41-64 SKILL.md:64-72 SKILL.md:72-84 SKILL.md:84-86 SKILL.md:86-92 SKILL.md:92 SKILL.md:93 SKILL.md:94 SKILL.md:95 SKILL.md:96 SKILL.md:100-111 SKILL.md:111-115 SKILL.md:115-127 SKILL.md:127-131 SKILL.md:131-143 SKILL.md:143-147 SKILL.md:147-156 SKILL.md:156-158 SKILL.md:158 SKILL.md:179-189 SKILL.md:189 SKILL.md:209-210 SKILL.md:210-211 SKILL.md:211-213 SKILL.md:213 SKILL.md:214 SKILL.md:219 SKILL.md:222 SKILL.md:223-224 SKILL.md:224-228 SKILL.md:228 SKILL.md:229 SKILL.md:231 SKILL.md:232 SKILL.md:256 SKILL.md:257-258 SKILL.md:258-260 SKILL.md:260 SKILL.md:263-272 SKILL.md:272 SKILL.md:273

🔑 Env variables (42)

📁 Filesystem access (16)

references/minimax-cli-reference.md:82 references/minimax-cli-reference.md:114 references/minimax-cli-reference.md:131 references/minimax-music-guide.md:29 references/minimax-tts-guide.md:37 scripts/minimax_image.py:88 scripts/minimax_image.py:80 scripts/minimax_image.py:119 scripts/minimax_image.py:97 scripts/minimax_music.py:141 scripts/minimax_music.py:148 scripts/minimax_music.py:127 scripts/minimax_tts.py:120 scripts/minimax_tts.py:105 scripts/minimax_video.py:131 scripts/minimax_video.py:130

🌐 Network access (25)

⚡ Contains scripts (1)

templates/generator_template.js:133

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/minimax-ai-frontend-dev/audits/7?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/minimax-ai-frontend-dev/security.svg)](https://skillstore.io/skills/minimax-ai-frontend-dev?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/minimax-ai-frontend-dev?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/minimax-ai-frontend-dev/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/minimax-ai-frontend-dev.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

MiniMax-AI. (2026). frontend-dev security audit report (audit version 7) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/minimax-ai-frontend-dev/audits/7

BibTeX citation

@techreport{minimax-ai-minimax-ai-frontend-dev-2026,
  author = {MiniMax-AI},
  title = {frontend-dev security audit report (audit version 7)},
  institution = {Skillstore},
  year = {2026},
  number = {7},
  url = {https://skillstore.io/skills/minimax-ai-frontend-dev/audits/7},
  note = {Author version 1.0.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "frontend-dev security audit report (audit version 7)"
version: "1.0.0"
type: report
authors:
  - name: "MiniMax-AI"
date-released: "2026-08-09"
url: "https://skillstore.io/skills/minimax-ai-frontend-dev/audits/7"
identifiers:
  - type: other
    value: "skillstore:minimax-ai-frontend-dev:audit:7"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Launch a Product Page

Create responsive sections, focused copy, local media, and restrained motion for a new offer.

Upgrade an Interface

Refine component structure, interaction states, performance, and accessibility in an existing frontend.

Produce Campaign Media

Coordinate page visuals, short video, narration, music, and conversion copy for a campaign.

Try These Prompts

Build a Simple Landing Page

Build a responsive landing page for [product]. Include a hero, benefits, proof, pricing, FAQ, and clear calls to action.

Refresh an Existing Frontend

Review this [framework] project. Improve layout, typography, states, mobile behavior, and accessibility while preserving current features and brand constraints.

Add a Motion System

Design motion for [page]. Choose suitable tools, define reduced-motion behavior, isolate expensive effects, and verify cleanup and mobile performance.

Create a Multimedia Experience

Build an immersive [campaign or product] experience using local generated media, conversion copy, responsive components, cinematic motion, and documented quality checks.

Best Practices

Confirm media prompts, destination paths, provider endpoints, and expected costs before generation.
Verify installed dependencies and existing framework conventions before changing project structure.
Test responsive states, keyboard access, reduced motion, loading behavior, and asset availability before delivery.

Avoid

Do not expose API keys in commands, logs, screenshots, generated files, or troubleshooting output.
Do not upload local file contents without checking scope and obtaining explicit user approval.
Do not combine heavy animation libraries in one component or ignore reduced-motion preferences.

Frequently Asked Questions

Which frontend frameworks are supported?

The guidance covers plain HTML, React, Next.js, Vue, Nuxt, Svelte, SvelteKit, and Astro.

Does media generation require MiniMax?

Yes. Included scripts call MiniMax APIs and require a valid key, trusted endpoint, network access, and account capacity.

Can it work with an existing project?

Yes. Provide the repository and constraints so the skill can follow current dependencies, components, styling, and brand rules.

Does it support accessible motion?

Yes. The workflow requires reduced-motion handling, visible focus states, pause controls, mobile fallbacks, and animation cleanup.

Can it create generative art?

Yes. It includes p5.js templates, seeded randomness guidance, bundled fonts, and workflows for static or interactive output.

What should I review before publishing?

Review generated media rights, copy claims, accessibility, responsive behavior, performance, endpoint trust, secrets handling, and production security.