Music Studio

面向大模型（LLM）的轻量音乐创作工作台，通过自然语言交互生成音乐、歌词与翻唱。默认采用保守的本地配置与输出管理方式，当前正式支持 MiniMax 歌词、`music-2.6` 文本生成音乐，以及 `music-cover` 前处理配合 `music-2.6` 的两阶段翻唱链路；只有明确说「打开音乐工作室」才进入...

What to check before installing: - The skill needs a provider API key (MiniMax). The code saves keys to ~/.config/music-studio/config.json in plaintext — do not publish that file or embed a real key in shared packages. Prefer using a throwaway or limited-scope key and run clear-key when done. - Registry metadata does not declare the required credential: treat that as a red flag and ensure you understand/approve where the key is stored before enabling the skill. - The skill will perform outbound network calls to https://api.minimaxi.com/v1 and will download user-supplied audio URLs (it fetches arbitrary URLs and writes them to disk). If you don't trust the remote audio URLs, avoid using the cover feature or inspect the URLs first. - Files (library.json, .url, .mp3, .meta.txt, lyrics files) are written into an output directory (default under the package output/ or an XDG-configured location). Check and set the output_dir in config if you want a specific location, and verify file permissions. - The skill’s activation is guarded by explicit trigger phrases in its conversation layer, but platform-level autonomous invocation could still call it; since it requires a local API key to do anything useful, the blast radius is limited unless you provide a key. - If you plan to publish or move this environment, run the provided prepublish_check and remove any config.json with real keys. Consider auditing the provider endpoint (api.minimaxi.com) and the MiniMax provider code if you require higher assurance. If you want more confidence: request that the publisher update the registry metadata to declare the primary credential and its storage behavior, or inspect/modify the code locally so keys are stored in a secret manager or not persisted.