Skills minimax-music-gen
📦
minimax-music-gen
v1.1 Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access
Generate Music with MiniMax
Creating complete songs from short ideas usually needs lyrics, arrangement, and production choices. This skill turns a music brief into MiniMax CLI steps for vocal, instrumental, and cover tracks.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "minimax-music-gen" from https://skillstore.io/skills/minimax-ai-minimax-music-gen.md and its manifest at https://skillstore.io/api/skills/minimax-ai-minimax-music-gen/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "minimax-music-gen". Generate a sad piano piece for a rainy city scene.
Expected outcome:
A preview lists an instrumental track with melancholic piano, light strings, slow tempo, and a saved MP3 path after generation.
Using "minimax-music-gen". Turn these lyrics into an upbeat pop song.
Expected outcome:
The skill formats the lyrics, proposes a pop prompt with vocal and production details, asks for confirmation, then generates the track.
Using "minimax-music-gen". Make an acoustic cover from this local audio file.
Expected outcome:
The skill asks for the source file and cover style, then creates a new version and offers playback or regeneration.
Security Audit
High Riskv4 • 7/5/2026 Open versioned report
The reviewed files describe a MiniMax music generation workflow that relies on the mmx CLI and the MiniMax API. Most scanner hits are Markdown backticks or benign prompt-writing prose, but the workflow includes external CLI execution, global package installation, persistent API credential storage, and user-controlled command arguments. No evidence found of prompt injection instructions or malicious data exfiltration intent.
2
Files scanned
539
Lines analyzed
35
Review items
0
False positives ignored
Confirmed security concerns (2)
High
Credential JSON file
Credentials are saved to `~/.mmx/credentials.json` and persist across sessions.
The referenced credentials.json path stores API credential material for mmx authentication and must be treated as sensitive.
High
User-Controlled Inputs Used in CLI Commands
The skill templates pass prompts, lyrics, audio file paths, and URLs from the user into mmx command arguments. If an agent builds these commands through a shell, unsafe quoting could cause command injection or unintended file and URL access.
The command templates show user-controlled placeholders for prompt, lyrics, source files, and source URLs in mmx invocations. The skill is documentation rather than executable code, so the risk depends on agent implementation.
Capability review items (35)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Ruby/shell backtick execution
```bash
This Markdown fence introduces an authentication command that accepts a MiniMax API key, creating secret-handling risk.
High
Ruby/shell backtick execution
```
This Markdown fence closes the API key authentication example; the surrounding block handles a sensitive credential.
High
Ruby/shell backtick execution
| mmx auth error (exit code 3) | `mmx auth login` |
The error-handling table instructs users to run mmx auth login, which involves sensitive account authentication.
High
Hidden file in home directory
Credentials are saved to `~/.mmx/credentials.json` and persist across sessions.
The workflow stores MiniMax credentials in a hidden file under the user home directory, creating persistent secret-storage risk.
Medium
Ruby/shell backtick execution
- **mmx CLI** (required): Music generation uses the `mmx` command-line tool.
The skill requires the mmx command-line tool, so use of this skill depends on running a third-party executable.
Medium
Ruby/shell backtick execution
```bash
This Markdown fence introduces a global npm installation command for mmx-cli, which has package supply-chain and filesystem impact.
Medium
Ruby/shell backtick execution
```
This Markdown fence closes the global npm installation example; the surrounding block instructs installing mmx-cli.
Medium
Ruby/shell backtick execution
```bash
This Markdown fence introduces an mmx quota command that may contact the MiniMax account service.
Medium
Ruby/shell backtick execution
```
This Markdown fence closes the mmx quota example, which is an external CLI operation against account state.
Medium
Ruby/shell backtick execution
This skill uses the `mmx` CLI for all music generation:
The skill states that all music generation uses the mmx CLI, confirming intended external command execution.
Medium
Ruby/shell backtick execution
- **Music Generation**: `mmx music generate` — model: `music-2.6-free`
The documented mmx music generate command calls an external CLI and MiniMax service to create audio.
Medium
Ruby/shell backtick execution
- **Cover**: `mmx music cover` — model: `music-cover-free`
The documented mmx music cover command calls an external CLI and service using reference audio input.
Medium
Ruby/shell backtick execution
**Agent flags**: Always add `--quiet --non-interactive` when calling mmx from agents.
The skill tells agents to run mmx with quiet non-interactive flags, so command execution may proceed without interactive prompts.
Medium
Ruby/shell backtick execution
- Vocal: `User description -> mmx music generate --lyrics-optimizer -> MP3`
The vocal workflow explicitly routes a user description into mmx music generation and produces an MP3 file.
Medium
Ruby/shell backtick execution
- Instrumental: `User description -> mmx music generate --instrumental -> MP3`
The instrumental workflow explicitly routes a user description into mmx music generation and produces an MP3 file.
Medium
Ruby/shell backtick execution
- Cover: `Source audio + style -> mmx music cover -> MP3`
The cover workflow explicitly routes source audio and style input into mmx music cover and produces an MP3 file.
Medium
Ruby/shell backtick execution
```bash
This Markdown fence introduces an mmx music generate command that sends prompt data to an external service and writes an MP3.
Medium
Ruby/shell backtick execution
```
This Markdown fence closes a vocal generation command that invokes mmx and writes output under the user home directory.
Medium
Ruby/shell backtick execution
```bash
This Markdown fence introduces an mmx command that passes user-provided lyrics into an external music generation CLI.
Medium
Ruby/shell backtick execution
```
This Markdown fence closes a command block that passes lyrics and style arguments to mmx.
Medium
Ruby/shell backtick execution
```bash
This Markdown fence introduces an instrumental mmx generation command that writes generated audio locally.
Medium
Ruby/shell backtick execution
```
This Markdown fence closes an instrumental generation command that invokes the external mmx CLI.
Medium
Ruby/shell backtick execution
| `mpv` (preferred) | `mpv --no-video ~/Music/minimax-gen/<filename>.mp3` | space = pause/resume, q
The mpv playback command launches a local external player against a generated audio file.
Medium
Ruby/shell backtick execution
| `ffplay` | `ffplay -nodisp -autoexit ~/Music/minimax-gen/<filename>.mp3` | q = quit |
The ffplay playback command launches a local external player against a generated audio file.
Medium
Ruby/shell backtick execution
| `afplay` (macOS) | `afplay ~/Music/minimax-gen/<filename>.mp3` | Ctrl+C = stop |
The afplay playback command launches a local external player against a generated audio file.
Medium
Ruby/shell backtick execution
```bash
This Markdown fence introduces an mmx cover command using a local reference audio file and writing generated output.
Medium
Ruby/shell backtick execution
```
This Markdown fence closes a cover-generation command that invokes the external mmx CLI.
Medium
Ruby/shell backtick execution
```bash
This Markdown fence introduces an mmx cover command that accepts an external audio URL.
Medium
Ruby/shell backtick execution
```
This Markdown fence closes a cover-generation command that can consume an external URL.
Medium
Ruby/shell backtick execution
```bash
This Markdown fence introduces an mmx cover command that passes custom lyrics into the CLI.
Medium
Ruby/shell backtick execution
```
This Markdown fence closes a cover command that passes user-supplied lyrics and audio file input.
Medium
Ruby/shell backtick execution
```bash
This Markdown fence introduces an mmx cover command that reads a lyrics file path.
Medium
Ruby/shell backtick execution
```
This Markdown fence closes a cover command that reads local audio and lyrics files.
Medium
Ruby/shell backtick execution
| mmx not found | `npm install -g mmx-cli` |
The error-handling table instructs users to install mmx-cli globally with npm, which is a real supply-chain risk.
Medium
Hidden file access
Credentials are saved to `~/.mmx/credentials.json` and persist across sessions.
The skill documents use of a hidden home-directory credential path, so filesystem access needs explicit user awareness.
Risk Factors
⚙️ External commands (78)
SKILL.md:24 SKILL.md:27-29 SKILL.md:29-32 SKILL.md:32-34 SKILL.md:34-37 SKILL.md:37-39 SKILL.md:39-41 SKILL.md:41-44 SKILL.md:44-46 SKILL.md:46-48 SKILL.md:48 SKILL.md:49-53 SKILL.md:53-55 SKILL.md:55 SKILL.md:56-57 SKILL.md:57-58 SKILL.md:58-59 SKILL.md:59 SKILL.md:61 SKILL.md:62 SKILL.md:63-65 SKILL.md:65-68 SKILL.md:68-69 SKILL.md:69-70 SKILL.md:70-74 SKILL.md:74-76 SKILL.md:76-120 SKILL.md:120-129 SKILL.md:129-148 SKILL.md:148-151 SKILL.md:151-158 SKILL.md:158-165 SKILL.md:165-177 SKILL.md:177-178 SKILL.md:178-180 SKILL.md:180-202 SKILL.md:202-210 SKILL.md:210-213 SKILL.md:213-220 SKILL.md:220-223 SKILL.md:223-230 SKILL.md:230-232 SKILL.md:232 SKILL.md:233 SKILL.md:234-245 SKILL.md:245-247 SKILL.md:247-253 SKILL.md:253 SKILL.md:254 SKILL.md:255 SKILL.md:260-263 SKILL.md:263-270 SKILL.md:270-274 SKILL.md:274-282 SKILL.md:282-288 SKILL.md:288-293 SKILL.md:293-301 SKILL.md:301-316 SKILL.md:316-322 SKILL.md:322-325 SKILL.md:325-331 SKILL.md:331-334 SKILL.md:334-341 SKILL.md:341-344 SKILL.md:344-351 SKILL.md:351-357 SKILL.md:357-358 SKILL.md:358 SKILL.md:359 SKILL.md:360-361 SKILL.md:361-372 SKILL.md:372-373 SKILL.md:373-389 SKILL.md:389 SKILL.md:390 SKILL.md:391-393 SKILL.md:393 SKILL.md:394
🌐 Network access (1)
📁 Filesystem access (2)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/minimax-ai-minimax-music-gen/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/minimax-ai-minimax-music-gen?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/minimax-ai-minimax-music-gen?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/minimax-ai-minimax-music-gen/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/minimax-ai-minimax-music-gen.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
MiniMax-AI. (2026). minimax-music-gen security audit report (audit version 4) [Author version 1.1]. Skillstore. https://skillstore.io/skills/minimax-ai-minimax-music-gen/audits/4BibTeX citation
@techreport{minimax-ai-minimax-ai-minimax-music-gen-2026,
author = {MiniMax-AI},
title = {minimax-music-gen security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/minimax-ai-minimax-music-gen/audits/4},
note = {Author version 1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "minimax-music-gen security audit report (audit version 4)"
version: "1.1"
type: report
authors:
- name: "MiniMax-AI"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/minimax-ai-minimax-music-gen/audits/4"
identifiers:
- type: other
value: "skillstore:minimax-ai-minimax-music-gen:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 41
Architecture
85
Maintainability
87
Content
70
Community
91
Spec Compliance
What You Can Build
Draft a Song Demo
Turn a rough theme into a vocal track with lyrics, genre, mood, and production direction.
Create Background Music
Generate instrumental music for videos, presentations, prototypes, or ambient scenes.
Explore Cover Styles
Use a reference audio file or URL to create a new cover-style version with original lyrics.
Try These Prompts
Make a Simple Track
Generate an instrumental track for a calm evening study session with warm piano, soft pads, and gentle percussion.
Create a Vocal Song
Create a hopeful indie pop song about starting over after a difficult year. Use clear English lyrics and a warm female vocal.
Refine Lyrics and Style
Use my lyrics and help refine the chorus. Then suggest genre, mood, vocal tone, instruments, and structure before generation.
Build a Cover Concept
Create a cover-style version from my audio file with original lyrics, acoustic guitar, intimate vocals, and a slower tempo.
Best Practices
- Give a clear mood, genre, tempo range, and two or three important instruments.
- Confirm lyrics, style, and output path before running generation.
- Use original lyrics for covers and avoid copyrighted text.
Avoid
- Do not paste copyrighted lyrics and ask for direct reproduction.
- Do not pass untrusted file paths or URLs without checking them first.
- Do not run authentication or package installation without explicit user approval.
Frequently Asked Questions
Does this skill generate audio directly?
Yes. It uses the mmx CLI to call MiniMax Music and save generated audio files locally.
Do I need a MiniMax API key?
Yes. The mmx CLI must be authenticated with a MiniMax API key before generation works.
Can it create instrumental music?
Yes. It supports instrumental generation with genre, mood, instruments, tempo, and structure controls.
Can I provide my own lyrics?
Yes. You can provide lyrics, edit sections, or let the lyrics optimizer generate lyrics from a theme.
Can it make cover versions?
Yes. It supports cover-style generation from a local audio file or an audio URL.
Where are generated files saved?
The skill saves generated tracks under the MiniMax music output directory in the user home folder.
Developer Details
Author
MiniMax-AILicense
MIT
Author version
v1.1
Skillstore revision
r1
Version notice
The author-declared version is not valid SemVer.
Ref
6425ec35f4ac137735cff58cd7877843bba23e3b
Maintenance freshness
7/18/2026
Usage
8 downloads · 192 views
File structure