Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Xiaomi MiMo Voice

v1.0.4

小米 MiMo V2 TTS 语音合成。支持中文、英文及多种风格(情感、角色扮演、方言、语速控制等)。

0· 146·0 current·0 all-time
byLuhui WANG@luhuiwang

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for luhuiwang/xiaomi-mimo-voice.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Xiaomi MiMo Voice" (luhuiwang/xiaomi-mimo-voice) from ClawHub.
Skill page: https://clawhub.ai/luhuiwang/xiaomi-mimo-voice
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install xiaomi-mimo-voice

ClawHub CLI

Package manager switcher

npx clawhub@latest install xiaomi-mimo-voice
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
Purpose & Capability
Name/description match the code and instructions: this is a small TTS client that calls an external MiMo TTS API and requires one API key. There are no unrelated credentials or extra binaries requested.
!
Instruction Scope
SKILL.md tells users to set MIMO_API_KEY under skills.entries in ~/.openclaw/openclaw.json (or export MIMO_API_KEY), but the script's fallback reads ~/.openclaw/openclaw.json at tools.mimoTts.apiKey. The mismatch means following the doc may not provide the key the script actually reads. Otherwise, instructions only ask to install requests and run the script, which is within expected scope.
Install Mechanism
No install spec — instruction-only with a small Python script. Dependency is requests (documented). Nothing is downloaded from untrusted URLs or written to system locations.
Credentials
The only secret needed is an API key, which is proportionate. The script reads MIMO_API_KEY from environment (expected) and also tries to read ~/.openclaw/openclaw.json (expected for local config) but looks under a different JSON path (tools.mimoTts.apiKey) than the SKILL.md recommends (skills.entries.xiaomi-mimo-voice.env). The script only reads that single local config file (read-only), not other credentials or system secrets.
Persistence & Privilege
Skill is not always-enabled, does not request persistent privileges, does not modify other skills or system-wide settings. Autonomous invocation is allowed by default but not combined with other high-risk flags.
What to consider before installing
This appears to be a legitimate TTS script, but the documentation and code disagree about where the API key lives. Before installing or supplying a key: (1) prefer setting MIMO_API_KEY as an environment variable (export MIMO_API_KEY=...) so the script will find it; (2) if you want to put the key in ~/.openclaw/openclaw.json, add it under tools.mimoTts.apiKey or edit the script to read skills.entries.xiaomi-mimo-voice.env.MIMO_API_KEY as the README suggests; (3) inspect the API host (https://api.xiaomimimo.com) to ensure it's the expected service for your key; and (4) if you need stronger assurance, ask the maintainer to fix the documentation/config mismatch or modify the script to accept the documented config path. There is no evidence of data exfiltration, but do not provide high-privilege credentials (AWS, GitHub tokens, etc.) — only the service API key should be used.

Like a lobster shell, security has layers — review code before you run it.

audiovk97c4kmp0fnh6yqt5yvhg0e89h83h7jwlatestvk97c4kmp0fnh6yqt5yvhg0e89h83h7jwmimovk97c4kmp0fnh6yqt5yvhg0e89h83h7jwttsvk97c4kmp0fnh6yqt5yvhg0e89h83h7jwvoicevk97c4kmp0fnh6yqt5yvhg0e89h83h7jwxiaomivk97c4kmp0fnh6yqt5yvhg0e89h83h7jw
146downloads
0stars
4versions
Updated 1mo ago
v1.0.4
MIT-0

Xiaomi MiMo Voice — 语音合成技能

通过小米 MiMo V2 TTS API 将文字转为自然流畅的语音。

前置条件

1. 安装依赖

pip install requests

2. 配置 API Key

编辑 ~/.openclaw/openclaw.json,在 skills.entries 下添加:

{
  "skills": {
    "entries": {
      "xiaomi-mimo-voice": {
        "enabled": true,
        "env": {
          "MIMO_API_KEY": "your-api-key"
        }
      }
    }
  }
}

💡 也可以使用环境变量 export MIMO_API_KEY=xxx,但推荐用 Skill 级别配置,更整洁且仅对该 Skill 生效。

使用方式

python3 <skill_dir>/scripts/tts.py --text "要合成的文字" --output audio.wav

参数

参数说明默认值
--text要合成的文字(必填,可含风格标签)
--output输出音频文件路径output.wav
--voice音色mimo_default
--style语音风格
--format输出格式:wav / pcm16wav
--user-text用户侧消息(辅助上下文)

音色

音色说明
mimo_default默认音色
default_zh中文优化
default_en英文优化

风格列表

类别风格
情感Happy · Sad · Angry · Surprised · Fearful · Disgusted · Calm
语速Speed up · Slow down
角色Sun Wukong · Lin Daiyu · Zhang Fei · Guan Yu · Zhuge Liang
风格Whisper · Clamped voice · Taiwanese accent
方言Northeastern dialect · Sichuan dialect · Cantonese · Henan dialect
其他唱歌 · Narration · Storytelling

示例

# 基础合成
python3 scripts/tts.py --text "你好,世界!" --output hello.wav

# 情感风格
python3 scripts/tts.py --text "太开心了!" --style Happy --output happy.wav

# 角色扮演
python3 scripts/tts.py --text "俺老孙来也!" --style "Sun Wukong" --output wukong.wav

# 英文
python3 scripts/tts.py --text "Hello world!" --voice default_en --output hello_en.wav

# 方言
python3 scripts/tts.py --text "干啥呢老铁" --style "Northeastern dialect" --output dongbei.wav

# 播报
python3 scripts/tts.py --text "以下是今天的新闻摘要" --style Narration --output news.wav

输出格式

{
  "status": "success",
  "file": "output.wav",
  "size_kb": 128.5,
  "duration_sec": 5.2,
  "voice": "mimo_default",
  "style": "Happy",
  "text": "太开心了!"
}

故障排除

问题原因解决方案
未设置 MIMO_API_KEY未配置 API Keyskills.entries.xiaomi-mimo-voice.env 中配置
API 返回异常Key 无效或过期检查 Key 是否正确
未获取到音频数据文本被拒绝检查文本内容
requests 超时网络问题检查网络连接
ImportError: requests缺少依赖pip install requests

技术细节

  • 模型:mimo-v2-tts
  • API:https://api.xiaomimimo.com/v1/chat/completions
  • 采样率:24kHz(PCM16 格式)
  • 风格标签格式:<style>风格</style> 放在文字开头

更新日志

v1.0.2 (2026-03-24)

  • 配置方式统一为 Skill 级别 env(openclaw.json skills.entries)
  • 修复依赖说明(openai → requests)
  • 文档结构优化

v1.0.1 (2026-03-24)

  • 移除 openclaw.json tools 自定义键配置
  • API Key 改为环境变量读取

v1.0.0 (2026-03-24)

  • 首次发布:中文/英文语音合成,支持情感/角色/方言等多种风格

Comments

Loading comments...