ClawHub
Back to skill

Security audit

Xiaomi MiMo Voice

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Xiaomi MiMo text-to-speech wrapper, with expected API-key use and outbound requests, but users should treat submitted text as shared with Xiaomi.

Install in a normal, non-admin environment, review the package source before using mutable npx or pip commands, and do not submit secrets, private personal data, or regulated content as TTS text unless you are comfortable sending it to Xiaomi's API.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:24
Finding

Unpinned Third-Party Dependencies and Installation Artifacts

Content
View full analysis

Vulnerability Details

File Locations:

  • SKILL.md:24-26
  • README.md:41-43

Vulnerability Type: Supply-chain risk caused by mutable, unverified dependencies
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md:24-26:

bash
pip install requests

README.md:41-43:

bash
npx clawhub install xiaomi-mimo-voice

Technical Analysis

The documented installation commands resolve third-party packages without specifying reviewed versions, lockfiles, package hashes, or other integrity constraints.

pip install requests installs whichever compatible release the configured Python package index serves at execution time. The npx command similarly invokes a package obtained through the configured npm registry and installs a mutable skill release. Consequently, the effective installation artifacts can change after this skill has been audited.

This does not establish that the current requests or clawhub packages are malicious. However, it creates a supply-chain exposure if a registry account, upstream release, package index, dependency, DNS path, or local registry configuration is compromised. Python source distributions and npm packages may execute installation or lifecycle code, making dependency installation a potential code-execution boundary.

Attack Path

  1. An attacker compromises an upstream package, dependency, maintainer account, package registry, or package-resolution path.
  2. The attacker publishes or serves a malicious package version that still satisfies the unpinned installation command.
  3. A user follows the documented pip install requests or npx clawhub install xiaomi-mimo-voice instruction.
  4. The package manager resolves the attacker-controlled release because no reviewed version or integrity hash is enforced.
  5. Malicious installation, build, lifecycle, or runtime code executes under the account running the command.
  6. That code can access resources available to the user, including project files, envir ...[truncated 925 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every direct dependency to a reviewed version, for example:
bash
python3 -m pip install requests==<reviewed-version>
  1. Provide a requirements or lock file containing cryptographic hashes:
text
requests==<reviewed-version> \
    --hash=sha256:<verified-package-hash>

Install it with hash enforcement:

bash
python3 -m pip install --require-hashes -r requirements.txt

  1. Lock and review all transitive dependencies rather than only the direct requests dependency.

  2. Pin the clawhub CLI and skill release to reviewed versions where the package manager supports it. Avoid implicitly resolving the latest available release.

  3. Document trusted package registries and discourage installation through untrusted mirrors or user-controlled registry configuration.

  4. Prefer isolated, non-privileged virtual environments. Explicitly warn users not to run installation commands with sudo or an administrative account.

  5. Generate and retain a software bill of materials, monitor dependencies for known vulnerabilities, and review package updates before changing pinned versions.

  6. Where supported, disable unnecessary package lifecycle scripts and verify package signatures or provenance attestations before installation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

The README instructs users to run npx clawhub install xiaomi-mimo-voice without pinning a specific version, which can cause users to fetch and execute whatever package version is current at install time. This creates a supply-chain risk: if the package or one of its distribution paths is compromised later, users may execute unintended code during installation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill documents capabilities that require environment variable access, reading local configuration, and outbound network access to a third-party API, but it does not declare any explicit tool scope or permissions. This weakens transparency and policy enforcement because users and hosting agents cannot clearly constrain or review what the skill is allowed to access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill asks users to provide --text and optional --user-text, but the description does not clearly warn that this content is transmitted to Xiaomi's external API for processing. Users may unknowingly send sensitive prompts, personal data, or proprietary content to a third party, creating privacy and compliance risks.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

md
# ============ 配置 ============
SAMPLE_RATE = 24000
BASE_URL = "https://api.xiaomimimo.com/v1/chat/completions"
MODEL = "mimo-v2-tts"

def _load_api_key() -> str:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/tts.py (reported line 19)May include surrounding context.

python
# ============ 配置 ============
SAMPLE_RATE = 24000
BASE_URL = "https://api.xiaomimimo.com/v1/chat/completions"
MODEL = "mimo-v2-tts"

def _load_api_key() -> str:

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/tts.py (reported line 79)May include surrounding context.

python
"Content-Type": "application/json",
    }

    resp = requests.post(BASE_URL, headers=headers, json=payload, timeout=60)
    resp.raise_for_status()

    data = resp.json()

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill description is written in Chinese and does not indicate any language selection or opt-in for users consuming the skill instructions. Under the policy rule, forcing a specific language without user choice can be a natural-language policy concern unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.