minimax-music-playlist

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill instructs the agent to 'Write scanning/analysis scripts on the fly as needed' using the Python standard library. This runtime code generation and execution creates a dynamic execution environment where the agent's generated logic is directly executed on the host system.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data from Spotify JSON exports and Apple Music track metadata. This data is processed by agent-generated scripts and used to construct prompts for the mmx CLI.
  • Ingestion points: Streaming_History_Audio_*.json files found on the file system and track/artist names retrieved via osascript.
  • Boundary markers: None specified for the processing of individual metadata fields.
  • Capability inventory: Shell command execution (find, osascript, mmx, mpv, ffplay, afplay), file system read/write, and dynamic Python script execution.
  • Sanitization: The instructions do not specify sanitization or escaping of metadata fields before they are interpolated into scripts or CLI prompts.
  • [COMMAND_EXECUTION]: The skill makes extensive use of shell commands to interact with the system, including find ~ -maxdepth 4 to search the user's home directory, osascript for Apple Music interaction, and various media players (mpv, ffplay, afplay) for playback.
  • [EXTERNAL_DOWNLOADS]: The skill fetches artist metadata from the MusicBrainz API (musicbrainz.org). This is documented as a neutral reference to a well-known service used for data enrichment.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 05:59 AM
Security Audit — agent-trust-hub — minimax-music-playlist