ClawHub
Back to skill

Security audit

Xiaomi-MiMo-V2-TTS

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent cloud text-to-speech wrapper, with expected network, credential, file-output, and ffmpeg behavior, but users should avoid sending sensitive text to the external Xiaomi API.

Install only if you are comfortable using Xiaomi's external TTS service. Do not synthesize secrets, confidential business text, personal data, or regulated content unless that transfer is approved. Use a virtual environment for Python dependencies, avoid privileged pip installs, and prefer pinned dependency versions where possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/tts.py:219
Finding

Predictable Temporary File Creation Enables Local File Clobbering

Content
View full analysis

Vulnerability Details

File Location: scripts/tts.py, lines 219-221
Vulnerability Type: Insecure temporary file creation
Risk Level: Medium

Vulnerable Code:

python
tmp_wav = tempfile.mktemp(suffix=".wav")
save_wav(audio_bytes, tmp_wav)
convert_to_opus(tmp_wav, output)

Technical Analysis

The application uses tempfile.mktemp() to generate a temporary WAV path. This function returns a filename without atomically creating or opening the corresponding file. A time-of-check-to-time-of-use window therefore exists between generating the path and opening it through save_wav().

A local attacker who can monitor or predict temporary filenames may create a symbolic link at the selected path before save_wav() opens it. Because wave.open(output_path, "wb") ultimately opens the path for writing, it may follow the attacker-created symbolic link and truncate or overwrite its target.

The vulnerable path is reached whenever Opus output is requested. Although the temporary file is removed in a finally block, cleanup occurs only after the potentially unsafe write and does not prevent exploitation.

Attack Path

  1. The victim runs the skill with --format opus.
  2. The script calls tempfile.mktemp() and receives an unreserved temporary filename.
  3. A local attacker identifies or predicts that filename before save_wav() opens it.
  4. The attacker creates a symbolic link from the temporary filename to a file writable by the victim process.
  5. save_wav() follows the symbolic link and opens the target in write mode.
  6. The target is truncated and replaced with generated audio data.
  7. If the skill runs under a privileged account, the overwrite may affect privileged files that the attacker could not directly modify.

Impact Assessment

Successful exploitation can corrupt or overwrite arbitrary files writable by the account executing the skill. The vulnerability does not independently gr ...[truncated 479 chars]

Remediation
View remediation

Remediation Suggestions

Replace tempfile.mktemp() with an API that atomically creates the temporary file:

python
fd, tmp_wav = tempfile.mkstemp(suffix=".wav")
os.close(fd)
try:
    save_wav(audio_bytes, tmp_wav)
    convert_to_opus(tmp_wav, output)
finally:
    if os.path.exists(tmp_wav):
        os.unlink(tmp_wav)

Alternatively, use tempfile.NamedTemporaryFile(suffix=".wav", delete=False) and close it before passing its path to ffmpeg.

Additional hardening should include:

  • Retaining restrictive permissions on the temporary file.
  • Creating temporary files only in a trusted directory.
  • Avoiding any unlink-and-reopen sequence that would recreate the race.
  • Running the skill with the least privileged account necessary.
  • Preserving cleanup in a finally block.

T08 · Insecure Dependencies

Note
Location
SKILL.md:24
Finding

Unpinned Runtime Dependencies Create Supply-Chain Exposure

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 24
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Low

Vulnerable Code:

bash
pip install requests && apt install ffmpeg

Technical Analysis

The documented installation command installs requests and ffmpeg without specifying reviewed versions. It also provides no package hashes, lock file, repository restrictions, or integrity-verification procedure.

Consequently, the code installed when a user follows the instructions can change over time without any corresponding change to the audited skill package. Package installation may execute package-controlled installation logic, while system packages can introduce behavior that differs from the version originally tested.

This is a supply-chain hardening weakness rather than evidence that either named dependency is currently malicious. The risk arises from trusting mutable package sources and unconstrained future versions.

Attack Path

  1. A user follows the installation command in SKILL.md.
  2. The package managers resolve the latest available versions from their configured repositories.
  3. A repository compromise, malicious mirror, compromised future release, or dependency-level compromise supplies an unsafe package version.
  4. The package is installed with the privileges used for pip or apt.
  5. Malicious installation logic or runtime code executes during installation or when the TTS script invokes the dependency.

Impact Assessment

The resulting privileges depend on how the installation command is executed. A user-level Python installation could execute code with that user's permissions. Installation through a privileged Python environment or the system package manager could affect the host more broadly and potentially execute code with administrative privileges.

Potential consequences include access to user data and credentials, modific ...[truncated 259 chars]

Remediation
View remediation

Remediation Suggestions

Pin dependencies to versions that have been reviewed and tested. For Python, provide a requirements file with hashes, for example:

text
requests==<reviewed-version> \
    --hash=sha256:<verified-distribution-hash>

Install it using hash enforcement:

bash
python3 -m pip install --require-hashes -r requirements.txt

Additional hardening should include:

  • Maintaining a lock file or fully pinned dependency manifest.
  • Restricting installation to trusted package indexes and operating-system repositories.
  • Pinning or documenting a tested ffmpeg package version.
  • Verifying package signatures and repository metadata where supported.
  • Installing dependencies in an isolated virtual environment.
  • Avoiding privileged pip installation.
  • Regularly reviewing pinned versions for security updates and updating hashes through a controlled process.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The README instructs users to run npx clawhub install xiaomi-mimo-voice without pinning an exact package version. This can cause users to fetch whatever version is current at execution time, increasing supply-chain risk if the package is updated maliciously, compromised, or unexpectedly changed.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill documentation shows capabilities that involve environment variables, file access, network calls, and shell commands, but it does not declare any explicit tool scope or permission boundaries. This increases the risk of overbroad execution in hosts that rely on manifest-level restrictions, making unintended file access, command execution, or network use harder to govern and audit.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs users to submit arbitrary text for synthesis through a remote Xiaomi MiMo API, but it does not clearly warn that the provided content will leave the local environment and be transmitted to a third party. Users may unknowingly send sensitive, regulated, or proprietary text to an external service, creating privacy and compliance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The documented API endpoint confirms that skill operation depends on transmitting data to an external service over the network. In context this is expected for cloud TTS, but it is still security-relevant because user content and possibly contextual fields such as --user-text may be exposed outside the local trust boundary.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

md
## 🔧 技术细节

- **模型**：mimo-v2-tts
- **API**：`https://api.xiaomimimo.com/v1/chat/completions`
- **采样率**：24kHz
- **自动重试**：失败自动重试 3 次（间隔 2 秒）
- **风格标签**：` <style>风格</style>` 放在文字开头

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/tts.py (reported line 21)May include surrounding context.

python
# ============ 配置 ============
SAMPLE_RATE = 24000
BASE_URL = "https://api.xiaomimimo.com/v1/chat/completions"
MODEL = "mimo-v2-tts"
MAX_RETRIES = 3
RETRY_DELAY = 2  # 秒

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/tts.py (reported line 93)May include surrounding context.

python
# 检查 ffmpeg 是否可用
    try:
        subprocess.run(["ffmpeg", "-version"], capture_output=True, check=True)
    except (FileNotFoundError, subprocess.CalledProcessError):
        print("⚠️  ffmpeg 未安装，opus 格式将不可用", file=sys.stderr)
        print("   安装方法: apt install ffmpeg / brew install ffmpeg", file=sys.stderr)

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The code sends text, optional user context, and authentication material to an external network endpoint. Although external transmission is expected for a cloud TTS skill, it still creates real data-exposure risk if sensitive content is synthesized or if operators are unaware that contextual text is uploaded to a third party.

Content

Scanner excerpt · scripts/tts.py (reported line 137)May include surrounding context.

python
last_error = None
    for attempt in range(1, MAX_RETRIES + 1):
        try:
            resp = requests.post(BASE_URL, headers=headers, json=payload, timeout=60)
            resp.raise_for_status()

            data = resp.json()

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script transmits user-provided text and optional 'user_text' context to a third-party Xiaomi API, but it does not provide an explicit privacy notice or consent checkpoint at the moment of transmission. In agent workflows, users may assume text is handled locally, so this can cause unintended disclosure of sensitive prompts, personal data, or confidential business content.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/tts.py (reported line 176)May include surrounding context.

python
def convert_to_opus(wav_path: str, opus_path: str):
    """用 ffmpeg 将 WAV 转为 OPUS 格式（飞书语音消息格式）"""
    result = subprocess.run(
        ["ffmpeg", "-i", wav_path, "-acodec", "libopus", "-ac", "1", "-ar", "16000", opus_path, "-y"],
        capture_output=True, text=True
    )

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The skill description and feature list are written primarily in Chinese, which can impose a language expectation on users without any stated opt-in or explanation that the skill is intended only for a Chinese-speaking or region-specific audience. Under the policy rule, natural-language content that effectively forces a specific language without user choice can be a locale-policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

Natural-language strings throughout the script, including the top-level description and CLI messages, are written only in Chinese. This imposes a specific language on users without opt-in or an explicit statement that the tool is intended only for Chinese-speaking contexts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.