MiMo 联网搜索

基于小米 MiMo 模型提供实时联网搜索，支持最新信息查询与资料核对，需配置 API Key 并付费使用。

Security Scan

The skill largely matches its stated purpose (MiMo web search) but metadata and runtime instructions/code disagree about required credentials, and the implementation uses shell-exec with unescaped JSON which creates a real injection risk — review before installing.

Purpose & Capability

The skill's name, SKILL.md, and code all describe a MiMo web-search integration and call https://api.xiaomimimo.com, which is coherent with the description. However the registry metadata declares no required environment variables or primary credential, while both SKILL.md and index.js require MIMO_API_KEY. The missing declared env var in the metadata is an inconsistency that should be corrected or explained. Source/homepage are unknown which reduces traceability.

Instruction Scope

The runtime instructions tell the agent to call the MiMo API via curl/exec and to store an API key in MIMO_API_KEY — that is within scope. However the provided code builds a shell curl command by embedding JSON that includes user-provided query text directly into a single-quoted string and then runs it via child_process.exec. This can lead to shell/command injection if queries contain special characters (the code does not properly escape or avoid the shell). The SKILL.md examples repeat this pattern. Tests (test.js) will attempt real API calls, so installing/running tests may make live requests/cost money.

Install Mechanism

There is no install spec (instruction-only style); the package contains small Node.js files with no external dependencies. No downloads from arbitrary URLs or package installs are requested. This limits supply-chain risk compared to remote fetch/install flows.

Credentials

Only a single credential (an API key) is actually required at runtime (MIMO_API_KEY), which is reasonable for a web-search integration. However the registry metadata fails to declare this required env var or a primaryEnv, creating a mismatch between what the skill needs and what the registry advertises. That mismatch reduces transparency and is a governance concern. No other unrelated secrets are requested.

Persistence & Privilege

The skill does not request always:true, does not modify other skills or system configs, and requires no special system privileges. autonomous invocation is allowed by default (not flagged here) and there is no evidence this skill attempts to persist tokens or escalate privileges.

What to consider before installing

Key things to consider before installing: - Metadata mismatch: the registry advertises no required env vars but both SKILL.md and index.js require MIMO_API_KEY. Ask the publisher to update the registry entry so the required credential is explicit (primaryEnv should be MIMO_API_KEY). - Shell injection risk: the implementation builds and runs a curl command via child_process.exec with the query embedded in JSON without proper escaping. Malicious or accidental input could break the command and enable injection. Prefer using an in-process HTTP client (fetch/axios/https.request) or securely escape inputs before using exec. - Verify the API endpoint and publisher: source/homepage are missing. Confirm api.xiaomimimo.com is the legitimate MiMo API endpoint and that you trust the publisher before providing an API key. - Costs and tests: test.js and examples will make live API calls and incur charges. Only run tests with a valid (and limited) API key and in an environment where you accept the billing risk. - Mitigations: update the package/registry metadata to declare MIMO_API_KEY, replace shell exec with a safe HTTP client or properly escape inputs, and limit the API key's scope/permissions where possible. If you cannot validate the endpoint or publisher, avoid installing or provide a restricted key.

MiMo 联网搜索技能

描述

使用小米 MiMo 模型的联网搜索功能进行实时信息搜索。

触发条件

• 用户要求搜索实时信息、最新动态或资料核对
• 用户提到 "搜索"、"查找"、"查询" 等关键词
• 需要获取最新网络信息时

工具

• exec: 调用 MiMo 联网搜索 API

配置要求

1. API Key: 需要配置 MIMO_API_KEY 环境变量
2. 模型支持: mimo-v2-pro, mimo-v2-omni, mimo-v2-flash
3. 计费: 中国区 ¥25 / 1K 次请求

使用方法

1. 配置 API Key

# 在 OpenClaw 配置文件中添加
MIMO_API_KEY=sk-your-api-key-here

2. 调用联网搜索 API

curl -X POST "https://api.xiaomimimo.com/v1/chat/completions" \
  -H "api-key: $MIMO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "mimo-v2-flash",
    "messages": [
      {
        "role": "user",
        "content": "你的搜索查询内容"
      }
    ],
    "tools": [
      {
        "type": "web_search",
        "max_keyword": 3,
        "force_search": true,
        "limit": 1
      }
    ],
    "max_completion_tokens": 1024,
    "temperature": 1.0,
    "top_p": 0.95,
    "stream": false,
    "thinking": {
      "type": "disabled"
    }
  }'

3. 在 OpenClaw 中使用

// 使用 exec 工具调用 MiMo 联网搜索
const command = `curl -X POST "https://api.xiaomimimo.com/v1/chat/completions" \
  -H "api-key: $MIMO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '${JSON.stringify({
    model: "mimo-v2-flash",
    messages: [{ role: "user", content: query }],
    tools: [{ type: "web_search", max_keyword: 3, force_search: true, limit: 1 }],
    max_completion_tokens: 1024,
    temperature: 1.0,
    top_p: 0.95,
    stream: false,
    thinking: { type: "disabled" }
  })}'`;

exec(command);

示例

搜索 MiMo 基准测试

const query = "MiMo-V2-Flash 的基准测试结果是什么？";
// 调用 API 获取搜索结果

搜索最新技术动态

const query = "2026 年 AI 大模型最新进展";
// 调用 API 获取搜索结果

注意事项

1. API Key 安全: 不要在代码中硬编码 API Key，使用环境变量
2. 计费控制: 联网搜索功能需要付费，注意控制调用频率
3. 模型选择: 确保使用支持联网搜索的模型（mimo-v2-flash 等）
4. 错误处理: 处理 API 调用失败的情况

故障排除

• 401 错误: API Key 无效或未配置
• 400 错误: 模型名称错误或参数不正确
• 网络错误: 检查网络连接和 API 端点