Agent skill · Audited from source

mmx-cli

skill · minimax-ai/cliLicence not declaredAudited 20 Oct 2026 · source 5cb975f05096

★ 2,199pushed 1 day ago
!CAUTIONGrade D · 64/100 · 23 findings · 5cb975f
2,199repo stars · whole minimax-ai/cli

Is it safe? With care — CAUTION, grade D (64/100). We read this skill's source at commit 5cb975f05096 and observed filesystem, network and shell access and a hard-coded secret (see the findings). The audit raised 23 findings, 0 critical or high. What it does: Use mmx to generate text, images, video, and speech, and to transcribe audio, via the MiniMax AI platform. Use when the user wants to create media content, chat with MiniMax models, transcribe audio to text, perform web…

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “mmx-cli (minimax-ai/cli)”. Retrieved 20 Oct 2026. https://modelsatlas.com/skills/minimax-ai/mmx-cli

Trust audit

Audit 0.4.1 · source read 20 Oct 2026

Trust score64/100!CAUTION D
0 critical0 high13 medium10 low0 info

CAUTION means the audit found things worth knowing before you trust this skill. Grade D is shared by 642 of 14,816 audited skills.

What the source does

  • FilesystemDeclared5 observations
  • NetworkDeclared12 observations
  • ShellDeclared3 observations
  • DependenciesNot pinnedSome versions float
  • SecretsFoundSee the findings; values are never shown

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityPASS1
L1 Static sourceSecrets, path traversal, supply chain, hidden codeWARN22
L2 InstructionsPrompt injection, authority framing, hidden directivesPASS0
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: no behavioural pass, no license.

Findings (23)

MEDIUMInformation disclosuredisclose.log_secret · src/commands/auth/status.ts:53
F-12 Information disclosureCWE-209 · CWE-532Layer L1
console.log(`  Key:    ${maskToken(token)}`);
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.beacon_words · src/commands/video/generate.ts:220
F-04 Network egressCWE-200 · CWE-319Layer L1
if (flags.callbackUrl) body.callback_url = flags.callbackUrl as string;
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.beacon_words · src/sdk/video/index.ts:186
F-04 Network egressCWE-200 · CWE-319Layer L1
callbackUrl: params.callback_url as string | undefined,
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.beacon_words · src/types/api.ts:238
F-04 Network egressCWE-200 · CWE-319Layer L1
callback_url?: string;
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.beacon_words · src/types/api.ts:299
F-04 Network egressCWE-200 · CWE-319Layer L1
callback_url?: string;
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.beacon_words · src/video/v2.ts:115
F-04 Network egressCWE-200 · CWE-319Layer L1
if (options.callbackUrl) request.callback_url = options.callbackUrl;
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.raw_ip · src/commands/config/set.ts:34
F-04 Network egressCWE-200 · CWE-319Layer L1
'mmx config set --key proxy --value http://127.0.0.1:7890',
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.raw_ip · src/commands/config/set.ts:92
F-04 Network egressCWE-200 · CWE-319Layer L1
`Invalid proxy "${value}". Must be a URL starting with http (e.g. http://127.0.0.1:7890).`,
Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · test/agent/verify.test.ts:29
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
apiKey: '…',
Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · test/agent/verify.test.ts:64
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
const apiKey = '…';
Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · test/agent/verify.test.ts:89
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
apiKey: '…',
Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · test/agent/verify.test.ts:107
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
apiKey: '…',
Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · test/agent/verify.test.ts:126
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
apiKey: '…',
Why
No further detail recorded for this rule.
Fix
—
LOWInventory / provenanceinv.no_license
F-13 Inventory / provenanceCWE-1104Layer L0
Why
no LICENSE file and no repo licence
Fix
add a licence
LOWFilesystem / pathfs.traversal · src/commands/agent/setup.ts:8
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import { defineCommand } from '../../command';
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · src/commands/agent/setup.ts:13
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
} from '../../agent/configurator';
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · src/commands/agent/setup.ts:14
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import { detectAvailableAgents } from '../../agent/availability';
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · src/commands/agent/setup.ts:19
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
} from '../../agent/installer';
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · src/commands/agent/setup.ts:28
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
} from '../../agent/types';
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · test/agent/verify.test.ts:253
F-04 Network egressCWE-200 · CWE-319Layer L1
proxy: 'http://127.0.0.1:10801',
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · test/auth/timeout-fix.test.ts:140
F-04 Network egressCWE-200 · CWE-319Layer L1
(REGIONS as Record<string, string>).global = 'http://127.0.0.1:1';
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · test/auth/timeout-fix.test.ts:141
F-04 Network egressCWE-200 · CWE-319Layer L1
(REGIONS as Record<string, string>).cn = 'http://127.0.0.1:1';
Why
No further detail recorded for this rule.
Fix
—
LOWSupply chainsupply.unpinned · package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
bun-plugin-dts, es-toolkit, jsonc-parser, picocolors, smol-toml, undici, yaml, @eslint/js
Why
12 dependency range(s) float
Fix
pin exact versions or ship a lockfile

Audit 0.4.1 · source sha 5cb975f05096 · 20 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publisherminimax-ai GitHub organizationOwner of the repository this skill is read from
  • Source folderminimax-ai/cliThe exact folder we audited
  • LicenceNot declaredAs the repository states it
  • Commit pinned for this verdict5cb975f05096A new audit runs when the source changes
  • Repository statusNot archivedLast push 1 day ago
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: Use mmx to generate text, images, video, and speech, and to transcribe audio, via the MiniMax AI platform. Use when the user wants to create media content, chat with MiniMax models, transcribe audio to text, perform web…

---
name: mmx-cli
description: Use mmx to generate text, images, video, and speech, and to transcribe audio, via the MiniMax AI platform. Use when the user wants to create media content, chat with MiniMax models, transcribe audio to text, perform web search, or manage MiniMax API resources from the terminal.
---

# MiniMax CLI — Agent Skill Guide

Use `mmx` to generate text, images, video, speech, transcribe audio, and perform web search via the MiniMax AI platform.

## Prerequisites

```bash
# Install
npm install -g mmx-cli

# Auth (OAuth persists to ~/.mmx/credentials.json, API key persists to ~/.mmx/config.json)
mmx auth login --api-key sk-xxxxx

# Verify active auth source
mmx auth status

# Or pass per-call
mmx text chat --api-key sk-xxxxx --message "Hello"
```

Region is auto-detected. Override with `--region global` or `--region cn`.

---

## Agent Flags

Always use these flags in non-interactive (agent/CI) contexts:

| Flag | Purpose |
|---|---|
| `--non-interactive` | Fail fast on missing args instead of prompting |
| `--quiet` | Suppress spinners/progress; stdout is pure data |
| `--output json` | Machine-readable JSON output |
| `--async` | Return task ID immediately (video generation) |
| `--dry-run` | Preview the API request without executing |
| `--yes` | Skip confirmation prompts |

---

## Commands

### text chat

Chat completion. Default model: `MiniMax-M3.1-Flash`. An explicit `--model` or saved `default-text-model` takes precedence. This model currently requires M Plan or MiniMax Code; with a pay-as-you-go key, use `--model MiniMax-M3`. Thinking is enabled by default with `max` effort. See the [model guide](https://platform.minimax.io/docs/guides/text-generation#agent).

```bash
mmx text chat --message <text> [flags]
```

| Flag | Type | Description |
|---|---|---|
| `--message <text>` | string, **required**, repeatable | Message text. Prefix with `role:` to set role (e.g. `"system:You are helpful"`, `"user:Hello"`) |
| `--messages-file <path>` | string | JSON file with messages array. Use `-` for stdin |
| `--system <text>` | string | System prompt |
| `--model <model>` | string | Model ID (default: `MiniMax-M3.1-Flash`) |
| `--max-tokens <n>` | number | Max tokens (default: 4096) |
| `--temperature <n>` | number | Sampling temperature (0.0, 1.0] |
| `--top-p <n>` | number | Nucleus sampling threshold |
| `--stream` | boolean | Stream tokens (default: on in TTY) |
| `--tool <json-or-path>` | string, repeatable | Tool definition JSON or file path |

```bash
# Single message
mmx text chat --message "user:What is MiniMax?" --output json --quiet

# Multi-turn
mmx text chat \
  --system "You are a coding assistant." \
  --message "user:Write fizzbuzz in Python" \
  --output json

# From file
cat conversation.json | mmx text chat --messages-file - --output json
```

**stdout**: response text (text mode) or full response object (json mode).

---

### image generate

Generate images. Model: `image-01`.

```bash
mmx image generate --prompt <text> [flags]
```

| Flag | Type | Description |
|---|---|---|
| `--prompt <text>` | string, **required** | Image description |
| `--aspect-ratio <ratio>` | string | e.g. `16:9`, `1:1`. Ignored if `--width` and `--height` are both set |
| `--n <count>` | number | Number of images (default: 1) |
| `--seed <n>` | number | Random seed for reproducible generation |
| `--width <px>` | number | Width in pixels (512–2048, multiple of 8). Requires `--height` |
| `--height <px>` | number | Height in pixels (512–2048, multiple of 8). Requires `--width` |
| `--prompt-optimizer` | boolean | Optimize prompt before generation |
| `--aigc-watermark` | boolean | Embed AI-generated content watermark |
| `--subject-ref <params>` | string | Subject reference: `type=character,image=path-or-url` |
| `--response-format <format>` | string | `url` (default) or `base64`. Base64 bypasses CDN download |
| `--out-dir <dir>` | string | Download images to directory |
| `--out-prefix <prefix>` | string | Filename prefix (default: `image`) |

```bash
mmx image generate --prompt "A cat in a spacesuit" --output json --quiet
# stdout: image URLs (one per line in quiet mode)

mmx image generate --prompt "Logo" --n 3 --out-dir ./gen/ --quiet
# stdout: saved file paths (one per line)
```

---

### video generate

Generate video. Default model: `MiniMax-Hailuo-2.3` (or `MiniMax-Hailuo-2.3-Fast` for fast mode with `--image`). This is an async task — by default it polls until completion.

For `MiniMax-H3` — text-to-video, first/last-frame, multimodal reference image/video/audio generation, prompt construction, and failure handling — use the dedicated [mmx-h3-video skill](h3-video/SKILL.md) instead.

```bash
mmx video generate --prompt <text> [flags]
```

| Flag | Type | Description |
|---|---|---|
| `--prompt <text>` | string, **required** | Video description |
| `--model <model>` | string | `MiniMax-Hailuo-2.3` (default) or `MiniMax-Hailuo-2.3-Fast` |
| `--image <path-or-url>` | string | Input image for image-to-video |
| `--last-frame <path-or-url>` | string | Optional ending image for frame interpolation (used with `--image`) |
| `--callback-url <url>` | string | Webhook URL for completion |
| `--download <path>` | string | Save video to specific file |
| `--async` | boolean | Return task ID immediately |
| `--no-wait` | boolean | Same as `--async` |
| `--poll-interval <seconds>` | number | Polling interval (default: 5) |

```bash
# Non-blocking: get task ID
mmx video generate --prompt "A robot." --async --quiet
# stdout: {"taskId":"..."}

# Blocking: wait and get file path
mmx video generate --prompt "Ocean waves." --download ocean.mp4 --quiet
# stdout: ocean.mp4
```

### video task get

Query status of a video generation task.

```bash
mmx video task get --task-id <id> [--output json]
```

### video download

Download a completed video by task ID.

```bash
mmx video download --file-id <id> [--out <path>]
```

---

### speech synthesize

Text-to-speech. Default model: `speech-

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit 5cb975f

Download folder ↗
npx skills add MiniMax-AI/cli -y -g
npm install -g mmx-cli
npm install mmx-cli

Commands as the repository documents them: shown, never run by us. Our verdict covers commit 5cb975f05096 only.

Works in which agents?

What its own text says, not a test

AgentStatusMore
Claude CodeMentioned in its text, not testedSkills for Claude Code · About Claude Code
CodexMentioned in its text, not testedSkills for Codex · About Codex
CursorMentioned in its text, not testedSkills for Cursor · About Cursor
OpenClawMentioned in its text, not testedSkills for OpenClaw · About OpenClaw
“Mentioned” means the skill’s text names the agent. We have not run it there.

Audit history

Every audit, every source change

  1. !CAUTION D 64 / 100

    first audit · source 5cb975f05096

README badge

For maintainers · shows the latest audit

ModelsAtlas: CAUTION DMODELSATLASCAUTION · D
[![ModelsAtlas: CAUTION D](https://modelsatlas.com/skills/minimax-ai/mmx-cli/badge.svg)](https://modelsatlas.com/skills/minimax-ai/mmx-cli/)

The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.

Similar skills

Add this badge to your README

[![ModelsAtlas: CAUTION D](https://modelsatlas.com/skills/minimax-ai/mmx-cli/badge.svg)](https://modelsatlas.com/skills/minimax-ai/mmx-cli/)

Questions about mmx-cli

What does the mmx-cli skill do?
Generate text, images, video, speech, and music by MiniMax.
Is mmx-cli safe to install?
With care. The audit graded it D (64/100) and found 23 things worth knowing before you trust this skill, listed below with the exact line each was found on.
What can mmx-cli access on my machine?
The audit observed that it reaches the network, runs shell commands and reads or writes files. Each of those is consistent with what it says it does. Secrets in the source: found — see the findings.
Which assistants does mmx-cli work with?
Its documentation mentions claude-code, codex, cursor and openclaw. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (5cb975f05096), read on 2026-10-20. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.