ClawHub
Back to skill

Security audit

Xiaomi MiMo TTS

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed Xiaomi text-to-speech integration, but it needs Review because bundled scripts contain a local code-execution flaw and the docs recommend unpinned package execution.

Install only if you are comfortable sending the text you synthesize to Xiaomi's MiMo API using your API key. Avoid the documented unpinned `npx` and unnecessary `pip install openai` examples unless you pin and trust the exact versions. Do not pass untrusted text through the shell `--dry-run` path until the heredoc interpolation bug is fixed, and prefer constraining outputs to a dedicated audio directory.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/base/mimo-tts.sh:30
Finding

Arbitrary Python Code Execution Through Unsafe Heredoc Interpolation

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
README.md:182
Finding

Unpinned Third-Party Package Installation and Execution Instructions

Content
View full analysis
温柔你好世界" output.ogg ``` ### Technical Analysis The README instructs users to install or execute registry packages without specifying an exact version or integrity constraint. The `npx` command may download the currently resolved package release and immediately execute its code. Consequently, the effective code executed by users can change after this Skill has been reviewed. A compromised publisher account, malicious upstream release, or package takeover could therefore turn the documented command into an arbitrary code-execution path. The unpinned `pip install openai` instruction has the same mutable-resolution concern. In addition, the reviewed Python implementation uses the standard library's `urllib.request` rather than the `openai` package, so this installation appears unnecessary for the bundled implementation and increases the dependency attack surface without supporting the declared runtime behavior. This finding concerns documented setup commands rather than code automatically executed during installation. Exploitation requires a user or automation system to follow the affected instructions. ### Attack Path 1. A user follows the README's `npx` or `pip install` instructions. 2. The package manager resolves an unspecified current version from its registry. 3. A malicious or compromised package release is downloaded. 4. For `npx`, downloaded package code is immediately executed; for `pip`, package installation hooks or later imports can execute package-controlled code. 5. The packa ...[truncated 782 chars]
Remediation
View remediation
run \ ~/.openclaw/skills/xiaomi-mimo-tts -- \ "温柔你好世界" output.ogg ``` The placeholder must be replaced with a specifically reviewed release. Where possible, verify package integrity and publisher provenance before execution. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (50)

Tainted flow: 'req' from os.environ.get (line 53, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/base/mimo_tts.py (reported line 62)May include surrounding context.

python
}
)
try:
    with urllib.request.urlopen(req, timeout=60) as resp:
        status = getattr(resp, 'status', None)
        resp_text = resp.read().decode('utf-8')
except Exception as e:

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

Accepting an undocumented credential source and dynamically selecting/executing local NodeJS, Python, or Shell implementations introduces hidden trust boundaries. In an agent context, dynamic interpreter selection and undeclared credential handling can lead to unpredictable execution, broader attack surface, and accidental use of the wrong secret source.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

Accepting an undocumented credential source and dynamically selecting/executing local NodeJS, Python, or Shell implementations introduces hidden trust boundaries. In an agent context, dynamic interpreter selection and undeclared credential handling can lead to unpredictable execution, broader attack surface, and accidental use of the wrong secret source.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding

Accepting an undocumented credential source and dynamically selecting/executing local NodeJS, Python, or Shell implementations introduces hidden trust boundaries. In an agent context, dynamic interpreter selection and undeclared credential handling can lead to unpredictable execution, broader attack surface, and accidental use of the wrong secret source.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Accepting an undocumented credential source and dynamically selecting/executing local NodeJS, Python, or Shell implementations introduces hidden trust boundaries. In an agent context, dynamic interpreter selection and undeclared credential handling can lead to unpredictable execution, broader attack surface, and accidental use of the wrong secret source.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

Accepting an undocumented credential source and dynamically selecting/executing local NodeJS, Python, or Shell implementations introduces hidden trust boundaries. In an agent context, dynamic interpreter selection and undeclared credential handling can lead to unpredictable execution, broader attack surface, and accidental use of the wrong secret source.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

Accepting an undocumented credential source and dynamically selecting/executing local NodeJS, Python, or Shell implementations introduces hidden trust boundaries. In an agent context, dynamic interpreter selection and undeclared credential handling can lead to unpredictable execution, broader attack surface, and accidental use of the wrong secret source.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

Accepting an undocumented credential source and dynamically selecting/executing local NodeJS, Python, or Shell implementations introduces hidden trust boundaries. In an agent context, dynamic interpreter selection and undeclared credential handling can lead to unpredictable execution, broader attack surface, and accidental use of the wrong secret source.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/_env.sh (reported line 22)May include surrounding context.

sh
# Reminder for agents/scripts: generated audio files are temporary artifacts.
# Agents/users should remove files in $SKILL_OUT when finished. Example:
#   rm -f "$SKILL_OUT"/*.ogg

# Helper: resolve a script path relative to SKILL_HOME
skill_path() {

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/base/mimo-tts.sh (reported line 61)May include surrounding context.

sh
| jq -r '.choices[0].message.audio.data' | base64 -d > "$OUTPUT.wav" || true

if command -v ffmpeg >/dev/null 2>&1; then
  ffmpeg -y -i "$OUTPUT.wav" -acodec libopus -b:a 128k "$OUTPUT" >/dev/null 2>&1 && rm -f "$OUTPUT.wav"
else
  echo "ffmpeg not found; leaving wav at $OUTPUT.wav"
  mv "$OUTPUT.wav" "$OUTPUT"

Unvalidated Output Injection

High
Category
Output Handling
Confidence
95% confidence
Finding

This mock-mode ffmpeg call has the same argument-injection-by-filename issue: an attacker-controlled output path beginning with '-' can be parsed as an ffmpeg option. In automation or multi-tenant agent environments, that can be abused to alter ffmpeg behavior or write to unexpected locations.

Content

Scanner excerpt · scripts/base/mimo_tts.py (reported line 37)May include surrounding context.

python
if MOCK:
    # generate mock silent ogg using ffmpeg if available
    try:
        subprocess.run(['ffmpeg','-f','lavfi','-i','anullsrc=r=16000:cl=mono','-t','0.5','-q:a','9','-acodec','libopus',output,'-y'],check=True,stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL)
    except Exception:
        open(output,'wb').close()
    print(output)

Unvalidated Output Injection

High
Category
Output Handling
Confidence
95% confidence
Finding

The output filename is user-controlled and passed directly to ffmpeg. Even without shell=True, many CLI tools treat leading-dash arguments as options, so a crafted output value could be interpreted by ffmpeg as an option rather than a filename, potentially causing unintended file writes, overwrites, or other unsafe behavior within the privileges of the running process.

Content

Scanner excerpt · scripts/base/mimo_tts.py (reported line 97)May include surrounding context.

python
# convert wav to ogg if ffmpeg exists
try:
    subprocess.run(['ffmpeg','-y','-i',wav_path,'-acodec','libopus','-b:a','128k',output], check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
    os.remove(wav_path)
except Exception as e:
    print('ffmpeg conversion failed:', e)

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The shell branch claims to use a shell implementation but actually re-invokes the same wrapper script, creating unbounded recursion whenever NodeJS and Python are unavailable. This can lead to denial of service through repeated process spawning, CPU consumption, and eventual resource exhaustion, and it also prevents the intended TTS function from completing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The natural-language instructions, usage guidance, and warnings in this file are presented only in Chinese, which effectively forces a specific language for users reading the skill documentation. The file does not offer an alternative language, opt-in, or a documented reason that the skill must be Chinese-only.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The README instructs users to run npx @openclaw/skill-runner without pinning a specific version, which means execution will fetch whatever package version is current at the time. If the upstream package is compromised, replaced, or updated with breaking or malicious behavior, users may execute unreviewed code directly from the registry.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill documentation describes capabilities that imply environment variable access, network calls, shell execution, and local file writes, but it does not declare any tool scope or permissions. In an agent setting, undeclared execution and I/O surfaces reduce transparency and can lead to over-privileged use or unsafe invocation of external tools and remote services.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/base/mimo-tts.sh (reported line 54)May include surrounding context.

sh
fi

# fallback: simple curl-based request
curl -s -X POST "https://api.xiaomimimo.com/v1/chat/completions" \
  -H "Authorization: Bearer ${XIAOMI_API_KEY}" \
  -H "Content-Type: application/json" \
  -d "$(printf '%s' "{\"model\":\"mimo-v2-tts\",\"messages\":[{\"role\":\"user\",\"content\":\"请朗读\"},{\"role\":\"assistant\",\"content\":\"$TEXT\"}],\"audio\":{\"format\":\"wav\",\"voice\":\"$VOICE\"}}")" \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script sends the provided text to an external API via curl and includes an Authorization header derived from XIAOMI_API_KEY. While there is a dry-run mode, the normal execution path has no visible confirmation prompt, user-facing notice, or explanatory comment warning that user text will be transmitted off-system using credentials.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The script usage example and API prompt include Chinese text ("文本" and "请朗读") and do not indicate that the skill is intentionally limited to Chinese or allow the user to select language/locale behavior. Under SQP-3, forcing a specific language without opt-in can be a policy issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script sends user-provided text to a remote Xiaomi API, which can expose sensitive or proprietary content if users assume processing is local. In a skill context, this is materially relevant because prompts or private text may be forwarded off-host without explicit disclosure or consent flow.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/base/mimo_tts.py (reported line 37)May include surrounding context.

python
if MOCK:
    # generate mock silent ogg using ffmpeg if available
    try:
        subprocess.run(['ffmpeg','-f','lavfi','-i','anullsrc=r=16000:cl=mono','-t','0.5','-q:a','9','-acodec','libopus',output,'-y'],check=True,stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL)
    except Exception:
        open(output,'wb').close()
    print(output)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script sends arbitrary input text to a third-party remote TTS service over the network, but it provides no explicit warning or consent checkpoint to users at the point of transmission. In agent/automation contexts, this can cause accidental disclosure of secrets, personal data, or sensitive internal content when users may assume processing is local.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/base/mimo_tts.py (reported line 97)May include surrounding context.

python
# convert wav to ogg if ffmpeg exists
try:
    subprocess.run(['ffmpeg','-y','-i',wav_path,'-acodec','libopus','-b:a','128k',output], check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
    os.remove(wav_path)
except Exception as e:
    print('ffmpeg conversion failed:', e)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This shell script presents all user-facing text, errors, and example invocations in Chinese, which effectively forces a specific language for users interacting with the skill. Under the policy, language constraints should be optional or clearly justified as region-specific; neither is present in this file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This shell script presents its title, usage guidance, status messages, and errors entirely in Chinese. That imposes a specific language on all users without opt-in, which matches the policy category for language/locale violations.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/base/mimo_tts.js:33

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/smart/mimo_tts_smart.js:16