Agent skill · Audited from source

minimax-music-playlist

skill · minimax-ai/skillsMIT licenceAudited 28 Oct 2026 · source ceddde63e832

★ 13,733pushed 193 days agoversion 2.0
!CAUTIONGrade B · 89/100 · 3 findings · ceddde6
13,733repo stars · whole minimax-ai/skills

Is it safe? With care — CAUTION, grade B (89/100). We read this skill's source at commit ceddde63e832 and found no filesystem, network or shell access and no hard-coded secrets. The audit raised 3 findings, 0 critical or high. What it does: Generate personalized music playlists by analyzing the user's music taste and generation feedback history. Triggers on any request involving playlist generation, music taste profiling, or personalized music…

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “minimax-music-playlist (minimax-ai/skills)”. Retrieved 28 Oct 2026. https://modelsatlas.com/skills/minimax-ai/minimax-music-playlist

Trust audit

Audit 0.4.1 · source read 28 Oct 2026

Trust score89/100!CAUTION B
0 critical0 high2 medium0 low1 info

CAUTION means the audit found things worth knowing before you trust this skill. Grade B is shared by 13,985 of 14,816 audited skills.

What the source does

  • FilesystemNone observedNo reads or writes in the source
  • NetworkNone observedNo outbound calls in the source
  • ShellNone observedNo commands run in the source
  • DependenciesPinnedNothing floats
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityPASS1
L1 Static sourceSecrets, path traversal, supply chain, hidden codeNA0
L2 InstructionsPrompt injection, authority framing, hidden directivesWARN2
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: no behavioural pass.

Findings (3)

MEDIUMObfuscation / stealthreview.concealment · SKILL.md
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L2
This is internal and should NOT be shown to the user
Why
It instructs the agent to hide the actual generation prompts from the user even though they are shown elsewhere as plan descriptions.
Fix
rewrite it so the instruction says plainly what it does, and asks the user before it acts
MEDIUMPrompt injectionreview.data_transfer · SKILL.md
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
For artists not in the mapping table, query the MusicBrainz API
Why
The skill sends artist names to an external MusicBrainz endpoint, transferring user taste data off the machine.
Fix
rewrite it so the instruction says plainly what it does, and asks the user before it acts
INFOInventory / provenanceinv.oversize · data/artist_genre_map.json
F-13 Inventory / provenanceCWE-1104Layer L0
data/artist_genre_map.json
Why
3187972 bytes not read
Fix
—

Audit 0.4.1 · source sha ceddde63e832 · 28 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publisherminimax-ai GitHub organizationOwner of the repository this skill is read from
  • Source folderminimax-ai/skills/skills/minimax-music-playlistThe exact folder we audited
  • LicenceMITAs the repository states it
  • Commit pinned for this verdictceddde63e832A new audit runs when the source changes
  • Repository statusNot archivedLast push 193 days ago
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: Generate personalized music playlists by analyzing the user's music taste and generation feedback history. Triggers on any request involving playlist generation, music taste profiling, or personalized music…

---
name: minimax-music-playlist
description: >
  Generate personalized music playlists by analyzing the user's music taste
  and generation feedback history. Triggers
  on any request involving playlist generation, music taste profiling, or personalized
  music recommendations. Supports multilingual triggers — match equivalent phrases in
  any language.
license: MIT
metadata:
  version: "2.0"
  category: creative
---

# MiniMax Music Playlist — Personalized Playlist Generator

Scan the user's music taste, build a taste profile, generate a personalized
playlist, and create an album cover. This skill is designed for both agent and direct
user invocation — adapt interaction style to context.

## Prerequisites

- **mmx CLI** — music & image generation. Install: `npm install -g mmx-cli`. Auth: `mmx auth login --api-key <key>`.
- **Python 3** — for scanning scripts you write on the fly (stdlib only, no pip).
- **Audio player** — `mpv`, `ffplay`, or `afplay` (macOS built-in).

## Language

Detect the user's language from their message. **All user-facing text must be
in the same language as the user's prompt** — do not mix languages. If the user
writes in Chinese, all output (profile summary, theme suggestions, playlist plan,
playback info) must be fully in Chinese. If in English, all in English.

All `mmx` generation prompts should be in English for best quality.
Each song's lyrics language follows its genre (K-pop → Korean, J-pop → Japanese, etc.),
NOT the user's UI language.

---

## Workflow

```
1. Scan local music apps → 2. Build taste profile → 3. Plan playlist
→ 4. Generate songs (mmx music) → 5. Generate cover (mmx image) → 6. Play → 7. Save & feedback
```

---

## Step 1: Gather Music Listening Data

Collect the user's listening data from available sources.

**Supported sources:**

| Source | Method | Data format |
|--------|--------|-------------|
| Apple Music | `osascript` to query Music.app (official AppleScript interface) | Track name, artist, album, genre, play count |
| Spotify | User exports their own data via [Spotify Privacy Settings](https://www.spotify.com/account/privacy/) | JSON files in ZIP (`Streaming_History_Audio_*.json`) |
| Manual input | User describes their taste directly | Free text |

**Spotify data export flow:**
Spotify does not store useful data locally. To include Spotify listening history,
first check if the user already has a Spotify data export:

1. Search for existing exports: `find ~ -maxdepth 4 -name "my_spotify_data.zip" -o -name "Streaming_History_Audio_*.json" 2>/dev/null`
2. If found, ask the user if they want to use it
3. If ZIP, unzip and locate `Spotify Extended Streaming History/Streaming_History_Audio_*.json`
4. If not found, open the Spotify privacy page: `open https://www.spotify.com/account/privacy/`
5. Tell the user to log in, scroll to "Download your data", and click "Request data"
6. Skip Spotify for now and continue with other sources — tell the user they can
   re-run the playlist skill after the data export arrives (usually a few days)

**Spotify data format:**
The export contains `Streaming_History_Audio_YYYY.json` files (one per year), each
is a JSON array of listening events. Key fields to extract:
- `master_metadata_album_artist_name` — artist name
- `master_metadata_track_name` — track name
- `master_metadata_album_album_name` — album name
- `ms_played` — playback duration in milliseconds (use as weight: longer = stronger signal)
- `ts` — timestamp

Filter out entries where `ms_played < 30000` (less than 30 seconds, likely skipped).
Do NOT use or store `ip_addr` or other sensitive fields.

**What to extract from each source:**
- Track names + artist names (primary signal)
- Playlist names and membership (e.g., a playlist named "Chinese Traditional" tells you genre preference)
- Play counts or streaming duration if available (weight frequently played tracks higher)
- Scene/mood tags if available

**Approach:**
1. Check if Apple Music is available (try `osascript` query)
2. Ask if the user has a Spotify data export ZIP to provide
3. If no sources available, ask the user to describe their taste manually

**Privacy rule:** Never show raw track lists to the user. Only show aggregated stats.

---

## Step 2: Build Taste Profile

From the scanned data, build a taste profile covering:

- **Genre distribution** — what styles the user listens to (e.g., J-pop 20%, R&B 15%, Classical 10%)
- **Mood tendencies** — emotional tone preferences (melancholic, energetic, calm, romantic, etc.)
- **Vocal preference** — male vs female voice ratio
- **Tempo preference** — slow / moderate / upbeat / fast distribution
- **Language distribution** — zh, en, ja, ko, etc.
- **Top artists** — most listened artists

**How to infer genre/mood from artist names:**
Most raw data only has artist + track names without genre tags. To enrich this:
1. Look up artists in the local mapping table at `<SKILL_DIR>/data/artist_genre_map.json`
   — this table covers 20,000 popular artists with pre-mapped genres, vocal type, and language
2. For artists not in the mapping table, query the MusicBrainz API:
   `https://musicbrainz.org/ws/2/artist/?query=artist:<name>&fmt=json`
   — extract genre tags from the response; respect rate limit (1 req/sec)
   — cache results to `<SKILL_DIR>/data/artist_cache.json` to avoid re-querying
3. If MusicBrainz returns no results, skip the artist

**Profile caching:**
- Save profile to `<SKILL_DIR>/data/taste_profile.json`
- If a profile less than 7 days old exists, reuse it (offer rescan option)
- If older or missing, rebuild

**Show user a summary:**
```
Your Music Profile:
  Sources: Apple Music 230 | Spotify 140
  Genres: J-pop 20% | R&B 15% | Classical 10% | Indie Pop 9%
  Moods: Melancholic 25% | Calm 20% | Romantic 18%
  Vocals: Female 65% | Male 35%
  Top artists: Faye Wong, Ryuichi Sakamoto, Taylor Swift, Jay Chou, Taeko Onuki
```

If invoked by an agent with clear parameters, skip the confirmation and proceed.
If invoked by a user dir

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit ceddde6

Download folder ↗
git clone https://github.com/minimax-ai/skills
git -C skills checkout ceddde63e832

The author documents no install command, so this uses the repository directly. Our verdict covers commit ceddde63e832 only.

Works in

The author has not said which agents this skill supports, and we have not tested it in any.

Audit history

Every audit, every source change

  1. !CAUTION B 89 / 100

    first audit · source ceddde63e832

README badge

For maintainers · shows the latest audit

ModelsAtlas: CAUTION BMODELSATLASCAUTION · B
[![ModelsAtlas: CAUTION B](https://modelsatlas.com/skills/minimax-ai/minimax-music-playlist/badge.svg)](https://modelsatlas.com/skills/minimax-ai/minimax-music-playlist/)

The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.

Similar skills

Add this badge to your README

[![ModelsAtlas: CAUTION B](https://modelsatlas.com/skills/minimax-ai/minimax-music-playlist/badge.svg)](https://modelsatlas.com/skills/minimax-ai/minimax-music-playlist/)

Questions about minimax-music-playlist

Is minimax-music-playlist safe to install?
With care. The audit graded it B (89/100) and found 3 things worth knowing before you trust this skill, listed below with the exact line each was found on.
What can minimax-music-playlist access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
How current is this page?
The grade is for one exact copy of the source (ceddde63e832), read on 2026-10-28. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.