mmMusicMaker

Create music with MiniMax music models (e.g., music-2.5). Use when generating songs or instrumental tracks from lyrics and style prompts, or when integrating...

This skill is plausibly what it says: a MiniMax music-generation client. Before installing, confirm you are willing to provide a MiniMax API key (MINIMAX_MUSIC_API_KEY) and that the domain api.minimaxi.com is the correct official endpoint for your account. The package metadata should be updated to declare the required env var; treat the omission as sloppy packaging rather than proof of malice. Also: (1) review the API key permissions and rotate the key if you later remove the skill, (2) ensure the runtime environment has the Python requests library, (3) sandbox execution if you want to be extra cautious (the script will POST your lyrics/prompts and will download any URL the API returns), and (4) prefer obtaining the skill from a known/trusted source or ask the publisher for corrected metadata if you need higher assurance.

Type: OpenClaw Skill Name: mm-music-maker Version: 1.0.0 The skill's core functionality is benign, aiming to generate music via the MiniMax API. However, the `scripts/generate_music.py` script, through its `--output` argument, allows a user to specify an arbitrary file path for saving the generated audio. This path is directly passed to `scripts/utils_audio.py`'s `save_bytes` and `download_url` functions, which use `pathlib.Path` to create and write to the specified file. While `pathlib` offers some path normalization, it does not prevent writing to sensitive system locations (e.g., `/etc/cron.d/`, `~/.ssh/`) if the agent has the necessary permissions. This constitutes an arbitrary file write vulnerability due to a lack of input sanitization, which could be exploited for privilege escalation or persistence, classifying the skill as suspicious rather than malicious due to the absence of clear intent for self-exploitation.