Agent skill · Audited from source
mmx-cli
skill · minimax-ai/cliLicence not declaredAudited 20 Oct 2026 · source 5cb975f05096
Is it safe? With care — CAUTION, grade D (64/100). We read this skill's source at commit 5cb975f05096 and observed filesystem, network and shell access and a hard-coded secret (see the findings). The audit raised 23 findings, 0 critical or high. What it does: Use mmx to generate text, images, video, and speech, and to transcribe audio, via the MiniMax AI platform. Use when the user wants to create media content, chat with MiniMax models, transcribe audio to text, perform web…
Cite
Cite this page
ModelsAtlas. “mmx-cli (minimax-ai/cli)”. Retrieved 20 Oct 2026. https://modelsatlas.com/skills/minimax-ai/mmx-cli
Trust audit
Audit 0.4.1 · source read 20 Oct 2026
CAUTION means the audit found things worth knowing before you trust this skill. Grade D is shared by 642 of 14,816 audited skills.
What the source does
- FilesystemDeclared5 observations
- NetworkDeclared12 observations
- ShellDeclared3 observations
- DependenciesNot pinnedSome versions float
- SecretsFoundSee the findings; values are never shown
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS | 1 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | WARN | 22 |
L2 Instructions | Prompt injection, authority framing, hidden directives | PASS | 0 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: no behavioural pass, no license.
Findings (23)
MEDIUMInformation disclosuredisclose.log_secret · src/commands/auth/status.ts:53
console.log(` Key: ${maskToken(token)}`);- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.beacon_words · src/commands/video/generate.ts:220
if (flags.callbackUrl) body.callback_url = flags.callbackUrl as string;
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.beacon_words · src/sdk/video/index.ts:186
callbackUrl: params.callback_url as string | undefined,
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.beacon_words · src/types/api.ts:238
callback_url?: string;
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.beacon_words · src/types/api.ts:299
callback_url?: string;
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.beacon_words · src/video/v2.ts:115
if (options.callbackUrl) request.callback_url = options.callbackUrl;
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.raw_ip · src/commands/config/set.ts:34
'mmx config set --key proxy --value http://127.0.0.1:7890',
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.raw_ip · src/commands/config/set.ts:92
`Invalid proxy "${value}". Must be a URL starting with http (e.g. http://127.0.0.1:7890).`,- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.generic · test/agent/verify.test.ts:29
apiKey: '…',
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.generic · test/agent/verify.test.ts:64
const apiKey = '…';
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.generic · test/agent/verify.test.ts:89
apiKey: '…',
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.generic · test/agent/verify.test.ts:107
apiKey: '…',
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.generic · test/agent/verify.test.ts:126
apiKey: '…',
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWInventory / provenanceinv.no_license
- Why
- no LICENSE file and no repo licence
- Fix
- add a licence
LOWFilesystem / pathfs.traversal · src/commands/agent/setup.ts:8
import { defineCommand } from '../../command';- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · src/commands/agent/setup.ts:13
} from '../../agent/configurator';
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · src/commands/agent/setup.ts:14
import { detectAvailableAgents } from '../../agent/availability';- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · src/commands/agent/setup.ts:19
} from '../../agent/installer';
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · src/commands/agent/setup.ts:28
} from '../../agent/types';
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · test/agent/verify.test.ts:253
proxy: 'http://127.0.0.1:10801',
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · test/auth/timeout-fix.test.ts:140
(REGIONS as Record<string, string>).global = 'http://127.0.0.1:1';
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · test/auth/timeout-fix.test.ts:141
(REGIONS as Record<string, string>).cn = 'http://127.0.0.1:1';
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWSupply chainsupply.unpinned · package.json
bun-plugin-dts, es-toolkit, jsonc-parser, picocolors, smol-toml, undici, yaml, @eslint/js
- Why
- 12 dependency range(s) float
- Fix
- pin exact versions or ship a lockfile
Audit 0.4.1 · source sha 5cb975f05096 · 20 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publisherminimax-ai GitHub organizationOwner of the repository this skill is read from
- Source folderminimax-ai/cliThe exact folder we audited
- LicenceNot declaredAs the repository states it
- Commit pinned for this verdict5cb975f05096A new audit runs when the source changes
- Repository statusNot archivedLast push 1 day ago
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: Use mmx to generate text, images, video, and speech, and to transcribe audio, via the MiniMax AI platform. Use when the user wants to create media content, chat with MiniMax models, transcribe audio to text, perform web…
---
name: mmx-cli
description: Use mmx to generate text, images, video, and speech, and to transcribe audio, via the MiniMax AI platform. Use when the user wants to create media content, chat with MiniMax models, transcribe audio to text, perform web search, or manage MiniMax API resources from the terminal.
---
# MiniMax CLI — Agent Skill Guide
Use `mmx` to generate text, images, video, speech, transcribe audio, and perform web search via the MiniMax AI platform.
## Prerequisites
```bash
# Install
npm install -g mmx-cli
# Auth (OAuth persists to ~/.mmx/credentials.json, API key persists to ~/.mmx/config.json)
mmx auth login --api-key sk-xxxxx
# Verify active auth source
mmx auth status
# Or pass per-call
mmx text chat --api-key sk-xxxxx --message "Hello"
```
Region is auto-detected. Override with `--region global` or `--region cn`.
---
## Agent Flags
Always use these flags in non-interactive (agent/CI) contexts:
| Flag | Purpose |
|---|---|
| `--non-interactive` | Fail fast on missing args instead of prompting |
| `--quiet` | Suppress spinners/progress; stdout is pure data |
| `--output json` | Machine-readable JSON output |
| `--async` | Return task ID immediately (video generation) |
| `--dry-run` | Preview the API request without executing |
| `--yes` | Skip confirmation prompts |
---
## Commands
### text chat
Chat completion. Default model: `MiniMax-M3.1-Flash`. An explicit `--model` or saved `default-text-model` takes precedence. This model currently requires M Plan or MiniMax Code; with a pay-as-you-go key, use `--model MiniMax-M3`. Thinking is enabled by default with `max` effort. See the [model guide](https://platform.minimax.io/docs/guides/text-generation#agent).
```bash
mmx text chat --message <text> [flags]
```
| Flag | Type | Description |
|---|---|---|
| `--message <text>` | string, **required**, repeatable | Message text. Prefix with `role:` to set role (e.g. `"system:You are helpful"`, `"user:Hello"`) |
| `--messages-file <path>` | string | JSON file with messages array. Use `-` for stdin |
| `--system <text>` | string | System prompt |
| `--model <model>` | string | Model ID (default: `MiniMax-M3.1-Flash`) |
| `--max-tokens <n>` | number | Max tokens (default: 4096) |
| `--temperature <n>` | number | Sampling temperature (0.0, 1.0] |
| `--top-p <n>` | number | Nucleus sampling threshold |
| `--stream` | boolean | Stream tokens (default: on in TTY) |
| `--tool <json-or-path>` | string, repeatable | Tool definition JSON or file path |
```bash
# Single message
mmx text chat --message "user:What is MiniMax?" --output json --quiet
# Multi-turn
mmx text chat \
--system "You are a coding assistant." \
--message "user:Write fizzbuzz in Python" \
--output json
# From file
cat conversation.json | mmx text chat --messages-file - --output json
```
**stdout**: response text (text mode) or full response object (json mode).
---
### image generate
Generate images. Model: `image-01`.
```bash
mmx image generate --prompt <text> [flags]
```
| Flag | Type | Description |
|---|---|---|
| `--prompt <text>` | string, **required** | Image description |
| `--aspect-ratio <ratio>` | string | e.g. `16:9`, `1:1`. Ignored if `--width` and `--height` are both set |
| `--n <count>` | number | Number of images (default: 1) |
| `--seed <n>` | number | Random seed for reproducible generation |
| `--width <px>` | number | Width in pixels (512–2048, multiple of 8). Requires `--height` |
| `--height <px>` | number | Height in pixels (512–2048, multiple of 8). Requires `--width` |
| `--prompt-optimizer` | boolean | Optimize prompt before generation |
| `--aigc-watermark` | boolean | Embed AI-generated content watermark |
| `--subject-ref <params>` | string | Subject reference: `type=character,image=path-or-url` |
| `--response-format <format>` | string | `url` (default) or `base64`. Base64 bypasses CDN download |
| `--out-dir <dir>` | string | Download images to directory |
| `--out-prefix <prefix>` | string | Filename prefix (default: `image`) |
```bash
mmx image generate --prompt "A cat in a spacesuit" --output json --quiet
# stdout: image URLs (one per line in quiet mode)
mmx image generate --prompt "Logo" --n 3 --out-dir ./gen/ --quiet
# stdout: saved file paths (one per line)
```
---
### video generate
Generate video. Default model: `MiniMax-Hailuo-2.3` (or `MiniMax-Hailuo-2.3-Fast` for fast mode with `--image`). This is an async task — by default it polls until completion.
For `MiniMax-H3` — text-to-video, first/last-frame, multimodal reference image/video/audio generation, prompt construction, and failure handling — use the dedicated [mmx-h3-video skill](h3-video/SKILL.md) instead.
```bash
mmx video generate --prompt <text> [flags]
```
| Flag | Type | Description |
|---|---|---|
| `--prompt <text>` | string, **required** | Video description |
| `--model <model>` | string | `MiniMax-Hailuo-2.3` (default) or `MiniMax-Hailuo-2.3-Fast` |
| `--image <path-or-url>` | string | Input image for image-to-video |
| `--last-frame <path-or-url>` | string | Optional ending image for frame interpolation (used with `--image`) |
| `--callback-url <url>` | string | Webhook URL for completion |
| `--download <path>` | string | Save video to specific file |
| `--async` | boolean | Return task ID immediately |
| `--no-wait` | boolean | Same as `--async` |
| `--poll-interval <seconds>` | number | Polling interval (default: 5) |
```bash
# Non-blocking: get task ID
mmx video generate --prompt "A robot." --async --quiet
# stdout: {"taskId":"..."}
# Blocking: wait and get file path
mmx video generate --prompt "Ocean waves." --download ocean.mp4 --quiet
# stdout: ocean.mp4
```
### video task get
Query status of a video generation task.
```bash
mmx video task get --task-id <id> [--output json]
```
### video download
Download a completed video by task ID.
```bash
mmx video download --file-id <id> [--out <path>]
```
---
### speech synthesize
Text-to-speech. Default model: `speech-Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit 5cb975f
npx skills add MiniMax-AI/cli -y -g npm install -g mmx-cli npm install mmx-cli
git clone https://github.com/minimax-ai/cli git -C cli checkout 5cb975f05096
Commands as the repository documents them: shown, never run by us. Our verdict covers commit 5cb975f05096 only.
Works in which agents?
What its own text says, not a test
| Agent | Status | More |
|---|---|---|
| Claude Code | Mentioned in its text, not tested | Skills for Claude Code · About Claude Code |
| Codex | Mentioned in its text, not tested | Skills for Codex · About Codex |
| Cursor | Mentioned in its text, not tested | Skills for Cursor · About Cursor |
| OpenClaw | Mentioned in its text, not tested | Skills for OpenClaw · About OpenClaw |
Audit history
Every audit, every source change
- !CAUTION D 64 / 100
first audit · source
5cb975f05096
README badge
For maintainers · shows the latest audit
[](https://modelsatlas.com/skills/minimax-ai/mmx-cli/)
The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.
Similar skills
obra/superpowers
Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions…
obra/superpowers
Use when you have a spec or requirements for a multi-step task, before touching code
obra/superpowers
Use when starting any conversation - establishes how to find and use skills, requiring skill invocation before ANY response including clarifying questions
obra/superpowers
Use when starting feature work that needs isolation from current workspace or before executing implementation plans - ensures an isolated workspace exists via native tools or git worktree fallback
obra/superpowers
Use when implementing any feature or bugfix, before writing implementation code
obra/superpowers
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes
Add this badge to your README
[](https://modelsatlas.com/skills/minimax-ai/mmx-cli/)
<a href="https://modelsatlas.com/skills/minimax-ai/mmx-cli/"><img src="https://modelsatlas.com/skills/minimax-ai/mmx-cli/badge.svg" alt="ModelsAtlas: CAUTION D"></a>
Questions about mmx-cli
What does the mmx-cli skill do?
Is mmx-cli safe to install?
What can mmx-cli access on my machine?
Which assistants does mmx-cli work with?
How current is this page?
Sources
- github.com/minimax-ai/cli — the audited source at commit 5cb975f05096 and every finding aboveObserved · 20 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the mmx-cli skill do?
- Is mmx-cli safe to install?
- What can mmx-cli access on my machine?