minimax-music-playlist
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The skill instructs the agent to 'Write scanning/analysis scripts on the fly as needed' using the Python standard library. This runtime code generation and execution creates a dynamic execution environment where the agent's generated logic is directly executed on the host system.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data from Spotify JSON exports and Apple Music track metadata. This data is processed by agent-generated scripts and used to construct prompts for the
mmxCLI. - Ingestion points:
Streaming_History_Audio_*.jsonfiles found on the file system and track/artist names retrieved viaosascript. - Boundary markers: None specified for the processing of individual metadata fields.
- Capability inventory: Shell command execution (
find,osascript,mmx,mpv,ffplay,afplay), file system read/write, and dynamic Python script execution. - Sanitization: The instructions do not specify sanitization or escaping of metadata fields before they are interpolated into scripts or CLI prompts.
- [COMMAND_EXECUTION]: The skill makes extensive use of shell commands to interact with the system, including
find ~ -maxdepth 4to search the user's home directory,osascriptfor Apple Music interaction, and various media players (mpv,ffplay,afplay) for playback. - [EXTERNAL_DOWNLOADS]: The skill fetches artist metadata from the MusicBrainz API (
musicbrainz.org). This is documented as a neutral reference to a well-known service used for data enrichment.
Audit Metadata