ClawHub
Back to skill

Security audit

Xiaomi MiMo Voice

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward cloud text-to-speech tool, but users should know their submitted text is sent to Xiaomi's MiMo API.

Install only if you are comfortable providing a MiMo API key and sending the text you synthesize, including any optional context, to Xiaomi's MiMo service. Avoid secrets, private messages, proprietary material, or regulated data unless you have reviewed and trust the provider's data handling terms.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding
The skill documentation indicates capabilities to read environment configuration, access files, and send data over the network, but it does not declare permissions or clearly scope those capabilities. In a skill ecosystem, missing permission declarations weaken transparency and reviewability, making it harder for users and platforms to assess what the skill can access before enabling it.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation explains that user-provided text is sent to a remote TTS API, but it does not warn users that prompts, messages, or contextual text may leave the local environment and be processed by a third party. This creates a privacy and data-handling risk, especially if users synthesize sensitive, personal, proprietary, or regulated content.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script transmits user-provided text and optional user_text context to a third-party remote API for synthesis, but it does not clearly warn users that their content will leave the local environment. This is a real privacy and data-handling issue because users may unknowingly send sensitive prompts, personal information, or proprietary text to an external service.

External Transmission

Medium
Category
Data Exfiltration
Content
## 技术细节

- 模型：`mimo-v2-tts`
- API：`https://api.xiaomimimo.com/v1/chat/completions`
- 采样率：24kHz（PCM16 格式）
- 风格标签格式：`<style>风格</style>` 放在文字开头
Confidence
83% confidence
Finding
https://api.xiaomimimo.com/

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.