Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed MyBooks client with broad but purpose-aligned library management and TTS features, not evidence of malicious behavior.
Install only if you trust the MyBooks server you configure. Use HTTPS for non-local hosts, keep MYBOOKS credentials in session-scoped environment variables, do not let the agent choose arbitrary upload files, and review TTS use carefully because API keys, voice samples, and book text may be processed by your MyBooks server and the configured TTS provider.
The code is a network client that authenticates and sends data to a configurable host, yet the skill metadata shown does not appear to cover network capability. In a skill context, hidden outbound connectivity materially increases risk because it can transmit user data, local files, or credentials to a server outside the operator's expectations.
The code is a network client that authenticates and sends data to a configurable host, yet the skill metadata shown does not appear to cover network capability. In a skill context, hidden outbound connectivity materially increases risk because it can transmit user data, local files, or credentials to a server outside the operator's expectations.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
API_TTS_PREFIX = "/api/toolbox/mimo_tts"
# book_upload only reads files with these extensions (blocks sending arbitrary
# local files such as ~/.ssh/id_rsa or .env to the server)
EBOOK_UPLOAD_EXTS = {"epub", "mobi", "azw", "azw3", "pdf", "txt", "lrf", "rtf", "djvu", "docx"}
ERROR_MESSAGES = {
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
API_TTS_PREFIX = "/api/toolbox/mimo_tts"
# book_upload only reads files with these extensions (blocks sending arbitrary
# local files such as ~/.ssh/id_rsa or .env to the server)
EBOOK_UPLOAD_EXTS = {"epub", "mobi", "azw", "azw3", "pdf", "txt", "lrf", "rtf", "djvu", "docx"}
ERROR_MESSAGES = {
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
if not save_to.lower().endswith(".wav"):
return {"status": "error", "message": "save_to must end with .wav"}
if os.path.exists(save_to):
return {"status": "error", "message": f"Refusing to overwrite existing file: {save_to}"}
with open(save_to, 'wb') as f:
f.write(content)
return {
The TTS configuration explicitly supports sending API credentials and book content-derived audio generation requests to a third-party endpoint outside the declared MYBOOKS_HOST boundary. This contradicts the earlier network declaration that the skill only accesses the user-configured MyBooks host, and creates a real data exfiltration path for secrets and potentially copyrighted/private book content.
| 参数 | 类型 | 必填 | 说明 |
|------|------|------|------|
| `api_url` | string | ✅ | API 地址，如 `https://api.xiaomimimo.com/v1/chat/completions` |
| `model_name` | string | ✅ | 模型 ID，MiMo TTS 类型固定为 `mimo-v2.5-tts` |
| `api_type` | string | ✅ | API 类型：`chat_completions`（MiMo TTS）/ `audio_speech`（OpenAI 兼容）/ `custom` |
| `api_key` | string | ✅ | API 密钥 |
The example command normalizes storing and transmitting an external TTS API key to https://api.xiaomimimo.com, which is a third-party service not covered by the stated network scope. Even though presented as documentation, it demonstrates and encourages a workflow where sensitive credentials are handled and outbound transmission occurs beyond the declared trust boundary.
执行脚本：
<skill-installation-path>/scripts/mybooks_api.py tts_save_config '{"api_url":"https://api.xiaomimimo.com/v1/chat/completions","model_name":"mimo-v2.5-tts","api_type":"chat_completions","api_key":"sk-xxx","voice_name":"mimo_default"}'
响应示例：
tts_convert requires direct submission of api_key and an arbitrary/external api_url, and the feature necessarily transmits book text or derived content to an outside TTS service for synthesis. In the context of a book-management skill that otherwise claims host-restricted networking, this materially increases risk by enabling off-platform disclosure of sensitive credentials and user/library content.
执行脚本：
<skill-installation-path>/scripts/mybooks_api.py tts_convert '{"book_id":42,"api_url":"https://api.xiaomimimo.com/v1/chat/completions","model_name":"mimo-v2.5-tts","api_type":"chat_completions","api_key":"sk-xxx","voice_name":"mimo_default"}'
响应示例：
The function uploads an arbitrary local MP3/WAV file specified by path to the remote server, and the code itself provides no consent interlock or warning before exfiltrating local content. In this skill, that is meaningful because the host is configurable and the feature can transfer user-owned voice samples, which are sensitive biometric-adjacent data, off the local system.
The function can write server-supplied binary data to an arbitrary local path chosen by the caller, with only an extension check and no directory restriction. Although it refuses overwrite, this still enables unauthorized file creation in arbitrary writable locations, which is risky in an agent environment because it can plant files in startup, shared, or sensitive working directories.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
Returns:
Tool execution result
"""
tool_method = getattr(self, tool_name, None)
if tool_method is None or not callable(tool_method):
available_tools = [
Detected: suspicious.env_credential_access