小米MiMo语音

• Outcome: Review
• Latest audit: Aug 31, 2026 · 3:44 PM UTC
• Version: 1.0.0

Overview

The skill’s core TTS function is understandable, but bundled scripts can also upload and send generated audio through Feishu/Lark without clear user-facing scope or confirmation.

Install only if you are comfortable sending text to Xiaomi MiMo for synthesis and you have reviewed or removed the Feishu/Lark helper scripts. Avoid using this skill for secrets or sensitive text, and treat any script that invokes lark-cli as capable of sending generated audio to a configured Feishu/Lark recipient.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (18)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

capture_output=True)
        
        # 上传到飞书
        upload = subprocess.run(
            ["lark-cli", "api", "POST", "/open-apis/im/v1/files",
             "--file", f"file={ogg_path}",
             "--data", json.dumps({"file_type": "opus", "file_name": f"{voice}.ogg"})],

• Confidence: 84% confidence
• Finding: This subprocess call uploads generated audio files to Feishu, creating an external data exfiltration/channel that exceeds the core TTS generation purpose of the skill. Even though the command itself is not shell-injectable, it transfers files off-host through a messaging platform and can expose generated content or metadata to third-party systems without explicit in-code safeguards.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if upload_data.get("ok"):
            file_key = upload_data["data"]["file_key"]
            content = json.dumps({"file_key": file_key})
            send = subprocess.run(
                ["lark-cli", "im", "+messages-send",
                 "--user-id", os.environ.get("FEISHU_USER_OPEN_ID", ""),
                 "--msg-type", "audio",

• Confidence: 86% confidence
• Finding: This subprocess sends audio messages to a Feishu user identified via environment configuration, adding outbound messaging capability unrelated to simple TTS synthesis. That broadens the skill from content generation into delivery/exfiltration, which is risky because it can transmit artifacts to external recipients without runtime confirmation or policy enforcement.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill documentation indicates use of environment variables and shell execution, but no explicit permissions are declared. In an agent ecosystem, this weakens sandboxing and informed consent because the skill can access secrets and invoke commands without a clearly scoped permission contract. The risk is elevated because the skill processes user-provided text and relies on external API credentials.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script sends generated audio files to Feishu, which exceeds the TTS-only purpose described in the skill metadata. This hidden expansion of capability is dangerous because it introduces external file delivery and potential data leakage through an unrelated messaging platform.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code implements external messaging and file delivery via Feishu, a capability not justified by the stated TTS skill purpose. Such scope creep is risky because it enables outbound transmission of generated content and recipient targeting beyond what users or reviewers would reasonably expect.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The skill is described as a TTS capability, but the code also uploads the synthesized audio and sends it through Feishu. That is materially broader than simple conversion and creates an undisclosed exfiltration path for user-provided content, especially dangerous in an agent-skill context where users may expect local or direct TTS behavior only.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: Including file-upload and message-send capabilities is not justified by the stated TTS purpose and expands the blast radius from synthesis to third-party distribution. In a skill ecosystem, this hidden capability can be abused to move user content off-platform or to an unintended recipient without meaningful user awareness.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The activation phrases are very broad, covering common requests like reading text aloud or converting text to speech. Overly generic triggers can cause the skill to activate unintentionally, sending user content to an external TTS provider when the user may not expect third-party transmission. In a voice/text assistant context, this increases privacy and data handling risk.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The script transmits audio files and a user identifier to Feishu without any clear user-facing warning, consent flow, or policy boundary in the code. This is dangerous because silent external transfer of artifacts and recipient metadata can violate least surprise, privacy expectations, and organizational controls.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script sends user-supplied text to a remote Xiaomi MiMo API over the network, which creates a privacy and data-handling risk if users assume TTS is purely local. In a TTS skill, this behavior is expected functionally, but it is still important because sensitive prompts, secrets, or personal data could be exfiltrated to a third-party service without explicit user awareness at the point of use.

Missing User Warnings

Low

• Confidence: 71% confidence
• Finding: Temporary audio files are written to /tmp, which can expose synthesized content to other local users or processes depending on system configuration, file permissions, and cleanup behavior. The risk is limited because the filenames are per-process and not obviously predictable beyond PID, but sensitive spoken content may still persist on disk unexpectedly.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script sends arbitrary user-provided text to an external TTS API without any in-script disclosure or consent flow. That is dangerous because users may provide sensitive content expecting local handling, while the skill silently transmits it to a third party.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The script writes predictable filenames in /tmp and overwrites them unconditionally, which can lead to data leakage between runs, accidental clobbering, or symlink-related file overwrite issues on shared systems. In multi-user or agent-hosted environments, predictable temp paths are riskier than in a single-user script.

External Transmission

Medium

• Category: Data Exfiltration

Content

try:
    proc = subprocess.run(
        ["curl", "-s", "-X", "POST", "https://api.xiaomimimo.com/v1/chat/completions",
         "-H", f"api-key: {API_KEY}",
         "-H", "Content-Type: application/json",
         "-d", payload],

• Confidence: 97% confidence
• Finding: The script transmits user-supplied text to an external third-party service at api.xiaomimimo.com for synthesis. In a TTS skill this is functionally expected, but it still creates a real data-exfiltration/privacy boundary because any text provided to the skill leaves the local environment and is processed by an external provider.

External Transmission

Medium

• Category: Data Exfiltration

Content

EOF)

# 调用 MiMo TTS API (通过 chat completions 接口)
RESPONSE=$(curl -s -X POST 'https://api.xiaomimimo.com/v1/chat/completions' \
    -H "api-key: $API_KEY" \
    -H 'Content-Type: application/json' \
    -d "$PAYLOAD")

• Confidence: 89% confidence
• Finding: The hard-coded remote API endpoint confirms dependency on an external service and corresponding disclosure of user input to that service. This is not inherently malicious, but in a voice synthesis tool it matters because users may not expect text to leave the host unless the skill states so unambiguously.

External Transmission

Medium

• Category: Data Exfiltration

Content

EOF)

# 调用 MiMo TTS API (通过 chat completions 接口)
RESPONSE=$(curl -s -X POST 'https://api.xiaomimimo.com/v1/chat/completions' \
    -H "api-key: $API_KEY" \
    -H 'Content-Type: application/json' \
    -d "$PAYLOAD")

• Confidence: 89% confidence
• Finding: The hard-coded remote API endpoint confirms dependency on an external service and corresponding disclosure of user input to that service. This is not inherently malicious, but in a voice synthesis tool it matters because users may not expect text to leave the host unless the skill states so unambiguously.

External Transmission

Medium

• Category: Data Exfiltration

Content

}, ensure_ascii=False)

proc = subprocess.run(
    ["curl", "-s", "-X", "POST", "https://api.xiaomimimo.com/v1/chat/completions",
     "-H", f"api-key: {API_KEY}",
     "-H", "Content-Type: application/json",
     "-d", payload],

• Confidence: 96% confidence
• Finding: The script transmits user text to an external domain for processing, which is an external data transfer with privacy implications. In this skill context, that risk is heightened because the manifest emphasizes TTS functionality but does not clearly communicate the remote processing and subsequent messaging flow.

Unvalidated Output Injection

High

• Category: Output Handling

Content

f.write(audio_bytes)

ogg_path = "/tmp/mimo_tts/voice.ogg"
subprocess.run(
    ["ffmpeg", "-y", "-i", wav_path, "-c:a", "libopus", "-b:a", "64k", "-ar", "48000", ogg_path],
    capture_output=True
)

• Confidence: 72% confidence
• Finding: The script decodes untrusted audio data returned by the external API and feeds it directly into ffmpeg without validation. While not a classic injection flaw, this can expose the host to malformed-media parser bugs or denial-of-service via oversized or corrupted content.

Static analysis

No suspicious patterns detected.