Security audit

小米MiMo语音

Security checks for vulnerabilities and agentic risk

Overview

The skill is mainly a MiMo text-to-speech helper, but bundled scripts can upload generated audio to Feishu and send it using existing credentials without top-level disclosure.

Review this before installing. Use the local-only speak.sh path only for non-sensitive text unless you are comfortable sending text to MiMo. Do not run speak_to_baobao.py or gen_all_voices.py unless you intentionally want generated audio uploaded and sent through Feishu, have verified the recipient, and understand which lark-cli account is authenticated.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/speak_to_baobao.py:60
Finding: Undisclosed Feishu Upload and Message Delivery Using Ambient Credentials
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/speak_to_baobao.py:43
Finding: Predictable Temporary Paths Allow File Collisions and Symlink-Based Write Redirection
Content: View full analysis
"$TMP_WAV" 2>/dev/null ``` `scripts/mimo_speak.py:65-68`: ```python os.makedirs("/tmp/mimo_tts", exist_ok=True) wav_path = "/tmp/mimo_tts/output.wav" with open(wav_path, "wb") as f: f.write(audio_bytes) ``` `scripts/speak_to_baobao.py:43-55`: ```python os.makedirs("/tmp/mimo_tts", exist_ok=True) wav_path = "/tmp/mimo_tts/voice.wav" with open(wav_path, "wb") as f: f.write(audio_bytes) ogg_path = "/tmp/mimo_tts/voice.ogg" subprocess.run( ["ffmpeg", "-y", "-i", wav_path, "-c:a", "libopus", "-b:a", "64k", "-ar", "48000", ogg_path], capture_output=True ) subprocess.run(["cp", ogg_path, "/tmp/speak.ogg"], capture_output=True) ``` `scripts/gen_all_voices.py:13,51-58`: ```python DIR = "/tmp/mimo_tts" ``` ```python wav_path = f"{DIR}/{voice}.wav" with open(wav_path, "wb") as f: f.write(audio_bytes) ogg_path = f"{DIR}/{voice}.ogg" subprocess.run(["ffmpeg", "-y", "-i", wav_path, "-c:a", "libopus", "-b:a", "64k", "-ar", "48000", ogg_path], capture_output=True) ``` ### Technical Analysis The scripts write to fixed or predictable paths in the shared `/tmp` namespace. The Python scripts use stable names such as `output.wav`, `voice.wav`, `voice.ogg`, and `/tmp/speak.ogg`. The shell script includes the process ID, but a PID-based filename remains predictable and is not created atomically. Neither the shell redirection nor Python's ordinary `open(..., "wb")` requests exclusive creation or rejects symbolic links. The shared `/tmp/mimo_tts` directory is also created without verifying ownership, type, or effective pe ...[truncated 1782 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/mimo_speak.py:50
Finding: MiMo API Key Is Passed Through Observable Process Arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/speak.sh:32
Finding: Unescaped User Input Permits JSON Payload Injection in the Bash Client
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (46)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The code does use MiMo TTS, so it is related to speech synthesis. However, its primary behavior is not a general-purpose skill that reads arbitrary user text aloud. Instead, it batch-generates sample clips for a hardcoded list of voices, saves and converts the audio locally, then uploads and sends those files through Feishu. Those messaging and file-upload behaviors are undeclared, and the script’s purpose is closer to internal voice-sample generation/distribution than an end-user TTS skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description says this is a MiMo text-to-speech skill, which is only part of what the code does. The primary code path is not merely synthesizing speech for local return/playback; it additionally packages and delivers the generated audio through Feishu messaging. That outbound messaging/integration behavior is a substantive undeclared capability and resource access mismatch relative to the description and empty permissions. Temporary file creation and ffmpeg conversion are supporting details, but the Feishu upload/send behavior materially changes the skill’s effective purpose from simple TTS to TTS-plus-message-delivery.
Content: No source excerpt is available for this finding.

Direct flow: os.environ.get (credential/environment) → subprocess.run (code execution)

High

Category: Data Flow
Confidence: 80% confidence
Finding: Data flows directly from a source (env vars, files, network) to a sink (network output, exec, file write) without intermediate validation.
Content: Scanner excerpt · scripts/gen_all_voices.py (reported line 75)May include surrounding context.
python
if upload_data.get("ok"): file_key = upload_data["data"]["file_key"] content = json.dumps({"file_key": file_key}) send = subprocess.run( ["lark-cli", "im", "+messages-send", "--user-id", os.environ.get("FEISHU_USER_OPEN_ID", ""), "--msg-type", "audio",

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · scripts/speak.sh (reported line 52)May include surrounding context.
sh
EOF) # 调用 MiMo TTS API (通过 chat completions 接口) RESPONSE=$(curl -s -X POST 'https://api.xiaomimimo.com/v1/chat/completions' \ -H "api-key: $API_KEY" \ -H 'Content-Type: application/json' \ -d "$PAYLOAD")

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill description presents this as a TTS fallback, but the code uploads and sends synthesized audio via Feishu, adding an undeclared communication capability. This scope mismatch is security-relevant because it can surprise users and reviewers, conceal exfiltration paths, and bypass least-privilege expectations for a narrowly described skill.
Content: No source excerpt is available for this finding.

Direct flow: os.environ.get (credential/environment) → subprocess.run (code execution)

High

Category: Data Flow
Confidence: 80% confidence
Finding: Data flows directly from a source (env vars, files, network) to a sink (network output, exec, file write) without intermediate validation.
Content: Scanner excerpt · scripts/speak_to_baobao.py (reported line 69)May include surrounding context.
python
file_key = upl_data.get("data", {}).get("file_key", "") if file_key: send = subprocess.run( ["lark-cli", "im", "+messages-send", "--user-id", os.environ.get("FEISHU_USER_OPEN_ID", ""), "--msg-type", "audio",

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill declares executable capabilities involving environment variables and shell-style commands but does not declare any corresponding tool scope or permissions boundary. This creates an authorization and review gap: a caller or platform may treat the skill as documentation-only while it actually relies on command execution and secret access.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger description is broad and includes common conversational phrases like read aloud, TTS, and convert text to voice, which can cause accidental invocation. In this context, accidental triggering matters because the skill sends user-provided text to an external third-party API, potentially disclosing content the user did not intend to export.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 87% confidence
Finding: The skill transmits user-provided text and an API bearer token to an external service over the network. While outbound transmission is expected for a cloud TTS skill, it is still security-relevant because sensitive user content may be exfiltrated to a third party if invoked on private text or without clear consent.
Content: Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.
基本语音合成

bash
curl -X POST 'https://api.xiaomimimo.com/v1/audio/speech' \ -H "Authorization: Bearer $MIMO_API_KEY" \ -H 'Content-Type: application/json' \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 87% confidence
Finding: The skill transmits user-provided text and an API bearer token to an external service over the network. While outbound transmission is expected for a cloud TTS skill, it is still security-relevant because sensitive user content may be exfiltrated to a third party if invoked on private text or without clear consent.
Content: Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.
基本语音合成

bash
curl -X POST 'https://api.xiaomimimo.com/v1/audio/speech' \ -H "Authorization: Bearer $MIMO_API_KEY" \ -H 'Content-Type: application/json' \ -d '{

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The docstring and generated content are written as fixed Chinese-language instructions and sample speech, and the script does not offer any language or locale opt-in. This appears to enforce a specific language behavior in natural-language content without documenting that the skill is intentionally limited to a Chinese-only context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script consumes sensitive environment variables and transmits data to external services automatically, but does not present any warning, consent step, or clear disclosure. In a skill advertised as TTS-focused, this makes external data flow less expected and therefore more security-significant.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/gen_all_voices.py (reported line 38)May include surrounding context.
python
}, ensure_ascii=False) # curl 请求 proc = subprocess.run( ["curl", "-s", "-X", "POST", "https://api.xiaomimimo.com/v1/chat/completions", "-H", f"api-key: {API_KEY}", "-H", "Content-Type: application/json",

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/mimo_speak.py (reported line 52)May include surrounding context.
python
}, ensure_ascii=False) # curl 请求 proc = subprocess.run( ["curl", "-s", "-X", "POST", "https://api.xiaomimimo.com/v1/chat/completions", "-H", f"api-key: {API_KEY}", "-H", "Content-Type: application/json",

Tainted flow: 'API_KEY' from os.environ.get (line 9, credential/environment) → subprocess.run (code execution)

Medium

Category: Data Flow
Confidence: 65% confidence
Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
Content: Scanner excerpt · scripts/gen_all_voices.py (reported line 38)May include surrounding context.
python
}, ensure_ascii=False) # curl 请求 proc = subprocess.run( ["curl", "-s", "-X", "POST", "https://api.xiaomimimo.com/v1/chat/completions", "-H", f"api-key: {API_KEY}", "-H", "Content-Type: application/json",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.
md
# curl 请求 proc = subprocess.run( ["curl", "-s", "-X", "POST", "https://api.xiaomimimo.com/v1/chat/completions", "-H", f"api-key: {API_KEY}", "-H", "Content-Type: application/json", "-d", payload],

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/gen_all_voices.py (reported line 39)May include surrounding context.
python
# curl 请求 proc = subprocess.run( ["curl", "-s", "-X", "POST", "https://api.xiaomimimo.com/v1/chat/completions", "-H", f"api-key: {API_KEY}", "-H", "Content-Type: application/json", "-d", payload],

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/gen_all_voices.py (reported line 60)May include surrounding context.
python
f.write(audio_bytes) ogg_path = f"{DIR}/{voice}.ogg" subprocess.run(["ffmpeg", "-y", "-i", wav_path, "-c:a", "libopus", "-b:a", "64k", "-ar", "48000", ogg_path], capture_output=True) # 上传到飞书

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script does more than synthesize speech: it uploads generated audio to Feishu and sends it to a recipient automatically. In a TTS skill, hidden outbound delivery expands the trust boundary and can leak user content or generated artifacts to an external messaging platform without clear user awareness or consent.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Adding external file-upload and messaging capability is unrelated to the core TTS function and creates an unnecessary exfiltration channel. If the script is reused with user-provided text, synthesized audio containing sensitive content could be transmitted to third-party infrastructure unexpectedly.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/gen_all_voices.py (reported line 64)May include surrounding context.
python
capture_output=True) # 上传到飞书 upload = subprocess.run( ["lark-cli", "api", "POST", "/open-apis/im/v1/files", "--file", f"file={ogg_path}", "--data", json.dumps({"file_type": "opus", "file_name": f"{voice}.ogg"})],

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/gen_all_voices.py (reported line 75)May include surrounding context.
python
if upload_data.get("ok"): file_key = upload_data["data"]["file_key"] content = json.dumps({"file_key": file_key}) send = subprocess.run( ["lark-cli", "im", "+messages-send", "--user-id", os.environ.get("FEISHU_USER_OPEN_ID", ""), "--msg-type", "audio",

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The top-level documentation says "语音合成并发送到飞书" (synthesize speech and send to Feishu), which implies an outbound delivery step. In reality, the code only calls the MiMo API, decodes audio, writes a WAV file locally, and prints its path; there is no Feishu integration.
Content: No source excerpt is available for this finding.

Tainted flow: 'API_KEY' from os.environ.get (line 30, credential/environment) → subprocess.run (code execution)

Medium

Category: Data Flow
Confidence: 65% confidence
Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
Content: Scanner excerpt · scripts/mimo_speak.py (reported line 52)May include surrounding context.
python
print(json.dumps({"status": "synthesizing", "text": TEXT, "voice": VOICE})) try: proc = subprocess.run( ["curl", "-s", "-X", "POST", "https://api.xiaomimimo.com/v1/chat/completions", "-H", f"api-key: {API_KEY}", "-H", "Content-Type: application/json",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: The script sends arbitrary user-provided text to an external third-party TTS API, which is a real data egress risk if the skill is used on sensitive content. In this skill context, external transmission is expected for cloud TTS, but it is still security-relevant because users may assume local synthesis or may unknowingly submit confidential data.
Content: Scanner excerpt · scripts/mimo_speak.py (reported line 53)May include surrounding context.
python
try: proc = subprocess.run( ["curl", "-s", "-X", "POST", "https://api.xiaomimimo.com/v1/chat/completions", "-H", f"api-key: {API_KEY}", "-H", "Content-Type: application/json", "-d", payload],

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Tp4

Tp4

Direct flow: os.environ.get (credential/environment) → subprocess.run (code execution)

External Script Fetching

Description-Behavior Mismatch

Direct flow: os.environ.get (credential/environment) → subprocess.run (code execution)

Undeclared Tool Scope

Vague Triggers

External Transmission

基本语音合成

External Transmission

基本语音合成

Natural-Language Policy Violations

Missing User Warnings

subprocess module call

subprocess module call

Tainted flow: 'API_KEY' from os.environ.get (line 9, credential/environment) → subprocess.run (code execution)

External Transmission

External Transmission

subprocess module call

Description-Behavior Mismatch

Context-Inappropriate Capability

subprocess module call

subprocess module call

Intent-Code Divergence

Tainted flow: 'API_KEY' from os.environ.get (line 30, credential/environment) → subprocess.run (code execution)

External Transmission

Static analysis