Agent skill · Audited from source
minimax-music-playlist
skill · minimax-ai/skillsMIT licenceAudited 28 Oct 2026 · source ceddde63e832
Is it safe? With care — CAUTION, grade B (89/100). We read this skill's source at commit ceddde63e832 and found no filesystem, network or shell access and no hard-coded secrets. The audit raised 3 findings, 0 critical or high. What it does: Generate personalized music playlists by analyzing the user's music taste and generation feedback history. Triggers on any request involving playlist generation, music taste profiling, or personalized music…
Cite
Cite this page
ModelsAtlas. “minimax-music-playlist (minimax-ai/skills)”. Retrieved 28 Oct 2026. https://modelsatlas.com/skills/minimax-ai/minimax-music-playlist
Trust audit
Audit 0.4.1 · source read 28 Oct 2026
CAUTION means the audit found things worth knowing before you trust this skill. Grade B is shared by 13,985 of 14,816 audited skills.
What the source does
- FilesystemNone observedNo reads or writes in the source
- NetworkNone observedNo outbound calls in the source
- ShellNone observedNo commands run in the source
- DependenciesPinnedNothing floats
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS | 1 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | NA | 0 |
L2 Instructions | Prompt injection, authority framing, hidden directives | WARN | 2 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: no behavioural pass.
Findings (3)
MEDIUMObfuscation / stealthreview.concealment · SKILL.md
This is internal and should NOT be shown to the user
- Why
- It instructs the agent to hide the actual generation prompts from the user even though they are shown elsewhere as plan descriptions.
- Fix
- rewrite it so the instruction says plainly what it does, and asks the user before it acts
MEDIUMPrompt injectionreview.data_transfer · SKILL.md
For artists not in the mapping table, query the MusicBrainz API
- Why
- The skill sends artist names to an external MusicBrainz endpoint, transferring user taste data off the machine.
- Fix
- rewrite it so the instruction says plainly what it does, and asks the user before it acts
INFOInventory / provenanceinv.oversize · data/artist_genre_map.json
data/artist_genre_map.json
- Why
- 3187972 bytes not read
- Fix
- —
Audit 0.4.1 · source sha ceddde63e832 · 28 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publisherminimax-ai GitHub organizationOwner of the repository this skill is read from
- Source folderminimax-ai/skills/skills/minimax-music-playlistThe exact folder we audited
- LicenceMITAs the repository states it
- Commit pinned for this verdictceddde63e832A new audit runs when the source changes
- Repository statusNot archivedLast push 193 days ago
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: Generate personalized music playlists by analyzing the user's music taste and generation feedback history. Triggers on any request involving playlist generation, music taste profiling, or personalized music…
--- name: minimax-music-playlist description: > Generate personalized music playlists by analyzing the user's music taste and generation feedback history. Triggers on any request involving playlist generation, music taste profiling, or personalized music recommendations. Supports multilingual triggers — match equivalent phrases in any language. license: MIT metadata: version: "2.0" category: creative --- # MiniMax Music Playlist — Personalized Playlist Generator Scan the user's music taste, build a taste profile, generate a personalized playlist, and create an album cover. This skill is designed for both agent and direct user invocation — adapt interaction style to context. ## Prerequisites - **mmx CLI** — music & image generation. Install: `npm install -g mmx-cli`. Auth: `mmx auth login --api-key <key>`. - **Python 3** — for scanning scripts you write on the fly (stdlib only, no pip). - **Audio player** — `mpv`, `ffplay`, or `afplay` (macOS built-in). ## Language Detect the user's language from their message. **All user-facing text must be in the same language as the user's prompt** — do not mix languages. If the user writes in Chinese, all output (profile summary, theme suggestions, playlist plan, playback info) must be fully in Chinese. If in English, all in English. All `mmx` generation prompts should be in English for best quality. Each song's lyrics language follows its genre (K-pop → Korean, J-pop → Japanese, etc.), NOT the user's UI language. --- ## Workflow ``` 1. Scan local music apps → 2. Build taste profile → 3. Plan playlist → 4. Generate songs (mmx music) → 5. Generate cover (mmx image) → 6. Play → 7. Save & feedback ``` --- ## Step 1: Gather Music Listening Data Collect the user's listening data from available sources. **Supported sources:** | Source | Method | Data format | |--------|--------|-------------| | Apple Music | `osascript` to query Music.app (official AppleScript interface) | Track name, artist, album, genre, play count | | Spotify | User exports their own data via [Spotify Privacy Settings](https://www.spotify.com/account/privacy/) | JSON files in ZIP (`Streaming_History_Audio_*.json`) | | Manual input | User describes their taste directly | Free text | **Spotify data export flow:** Spotify does not store useful data locally. To include Spotify listening history, first check if the user already has a Spotify data export: 1. Search for existing exports: `find ~ -maxdepth 4 -name "my_spotify_data.zip" -o -name "Streaming_History_Audio_*.json" 2>/dev/null` 2. If found, ask the user if they want to use it 3. If ZIP, unzip and locate `Spotify Extended Streaming History/Streaming_History_Audio_*.json` 4. If not found, open the Spotify privacy page: `open https://www.spotify.com/account/privacy/` 5. Tell the user to log in, scroll to "Download your data", and click "Request data" 6. Skip Spotify for now and continue with other sources — tell the user they can re-run the playlist skill after the data export arrives (usually a few days) **Spotify data format:** The export contains `Streaming_History_Audio_YYYY.json` files (one per year), each is a JSON array of listening events. Key fields to extract: - `master_metadata_album_artist_name` — artist name - `master_metadata_track_name` — track name - `master_metadata_album_album_name` — album name - `ms_played` — playback duration in milliseconds (use as weight: longer = stronger signal) - `ts` — timestamp Filter out entries where `ms_played < 30000` (less than 30 seconds, likely skipped). Do NOT use or store `ip_addr` or other sensitive fields. **What to extract from each source:** - Track names + artist names (primary signal) - Playlist names and membership (e.g., a playlist named "Chinese Traditional" tells you genre preference) - Play counts or streaming duration if available (weight frequently played tracks higher) - Scene/mood tags if available **Approach:** 1. Check if Apple Music is available (try `osascript` query) 2. Ask if the user has a Spotify data export ZIP to provide 3. If no sources available, ask the user to describe their taste manually **Privacy rule:** Never show raw track lists to the user. Only show aggregated stats. --- ## Step 2: Build Taste Profile From the scanned data, build a taste profile covering: - **Genre distribution** — what styles the user listens to (e.g., J-pop 20%, R&B 15%, Classical 10%) - **Mood tendencies** — emotional tone preferences (melancholic, energetic, calm, romantic, etc.) - **Vocal preference** — male vs female voice ratio - **Tempo preference** — slow / moderate / upbeat / fast distribution - **Language distribution** — zh, en, ja, ko, etc. - **Top artists** — most listened artists **How to infer genre/mood from artist names:** Most raw data only has artist + track names without genre tags. To enrich this: 1. Look up artists in the local mapping table at `<SKILL_DIR>/data/artist_genre_map.json` — this table covers 20,000 popular artists with pre-mapped genres, vocal type, and language 2. For artists not in the mapping table, query the MusicBrainz API: `https://musicbrainz.org/ws/2/artist/?query=artist:<name>&fmt=json` — extract genre tags from the response; respect rate limit (1 req/sec) — cache results to `<SKILL_DIR>/data/artist_cache.json` to avoid re-querying 3. If MusicBrainz returns no results, skip the artist **Profile caching:** - Save profile to `<SKILL_DIR>/data/taste_profile.json` - If a profile less than 7 days old exists, reuse it (offer rescan option) - If older or missing, rebuild **Show user a summary:** ``` Your Music Profile: Sources: Apple Music 230 | Spotify 140 Genres: J-pop 20% | R&B 15% | Classical 10% | Indie Pop 9% Moods: Melancholic 25% | Calm 20% | Romantic 18% Vocals: Female 65% | Male 35% Top artists: Faye Wong, Ryuichi Sakamoto, Taylor Swift, Jay Chou, Taeko Onuki ``` If invoked by an agent with clear parameters, skip the confirmation and proceed. If invoked by a user dir
Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit ceddde6
git clone https://github.com/minimax-ai/skills git -C skills checkout ceddde63e832
The author documents no install command, so this uses the repository directly. Our verdict covers commit ceddde63e832 only.
Works in
The author has not said which agents this skill supports, and we have not tested it in any.
Audit history
Every audit, every source change
- !CAUTION B 89 / 100
first audit · source
ceddde63e832
README badge
For maintainers · shows the latest audit
[](https://modelsatlas.com/skills/minimax-ai/minimax-music-playlist/)
The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.
Similar skills
obra/superpowers
Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions…
obra/superpowers
Use when you have a spec or requirements for a multi-step task, before touching code
obra/superpowers
Use when starting any conversation - establishes how to find and use skills, requiring skill invocation before ANY response including clarifying questions
Add this badge to your README
[](https://modelsatlas.com/skills/minimax-ai/minimax-music-playlist/)
<a href="https://modelsatlas.com/skills/minimax-ai/minimax-music-playlist/"><img src="https://modelsatlas.com/skills/minimax-ai/minimax-music-playlist/badge.svg" alt="ModelsAtlas: CAUTION B"></a>
Questions about minimax-music-playlist
Is minimax-music-playlist safe to install?
What can minimax-music-playlist access on my machine?
How current is this page?
Sources
- github.com/minimax-ai/skills/tree/main/skills/minimax-music-play — the audited source at commit ceddde63e832 and every finding aboveObserved · 28 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- Is minimax-music-playlist safe to install?
- What can minimax-music-playlist access on my machine?
- How current is this page?