Security audit

xiaoai-bridge

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent XiaoAi voice-bridge purpose, but it ships sensitive Xiaomi session data and includes unsafe integration examples that need review before installation.

Do not install this package as-is. The publisher should remove the committed Xiaomi token/device file, revoke exposed sessions, replace unsafe exec examples with spawn or execFile argument arrays, stop printing transcripts by default, add clear privacy and consent guidance, and regenerate dependencies from an HTTPS registry. If you still test it, use a throwaway or tightly scoped Xiaomi account, a non-empty trigger prefix, and an unprivileged runtime environment.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/.mi.json:1
Finding: Committed Xiaomi Authentication Tokens and Sensitive Device Metadata
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:108
Finding: Shell Command Injection in the Documented TTS Integration
Content: View full analysis
{ exec(`node skills/xiaoai-bridge/scripts/xiaoai-listen.js speak "${text}"`, (error, stdout, stderr) => { if (error) reject(error); else resolve(); } ); }); } ``` ```javascript async speak(text) { const scriptPath = path.join(__dirname, 'skills/xiaoai-bridge/scripts/xiaoai-listen.js'); return new Promise((resolve, reject) => { exec(`node ${scriptPath} speak "${text}"`, (error) => { if (error) reject(error); else resolve(); }); }); } ``` ### Technical Analysis The integration examples pass AI-generated or otherwise externally influenced text into `child_process.exec()` by concatenating it into a command string. `exec()` invokes a system shell. Wrapping the value in double quotes does not make it safe because shell command substitutions and quote-breaking payloads can still be interpreted. For example, a response containing a closing quote followed by shell syntax can escape the intended argument. On shells that support command substitution, constructs inside double quotes may also be evaluated. The shipped `xiaoai-listen.js` CLI reads `process.argv[3]` and does not itself invoke a shell. The vulnerability is introduced by the documented wrapper code, which encourages users to invoke that otherwise-safe CLI through `exec()` with untrusted interpolation. ### Attack Path 1. An attacker supplies a crafted voice instruction or ot ...[truncated 1386 chars]
Remediation: View remediation
{ const child = spawn( process.execPath, [scriptPath, "speak", text], { shell: false, stdio: ["ignore", "pipe", "pipe"] } ); child.once("error", reject); child.once("exit", (code) => { if (code === 0) resolve(); else reject(new Error(`TTS process exited with code ${code}`)); }); }); } ``` Additional hardening should include: 1. Update every vulnerable example, not only one occurrence. 2. Never use shell escaping as the primary defense when an argument-array API is available. 3. Resolve and validate `scriptPath` as an expected local file. 4. Apply reasonable length limits to TTS text to prevent resource exhaustion. 5. Run the bridge as a dedicated, unprivileged operating-system account. 6. Provide only the environment variables required by the child process. 7. Add tests containing quotes, semicolons, newlines, command substitutions, and platform-specific metacharacters to confirm they are handled as literal text. ]]>

T08 · Insecure Dependencies

Warning

Location: scripts/package-lock.json:17
Finding: Dependency Lockfile Uses Plaintext HTTP Third-Party Package URLs
Content: View full analysis
=16" } } ``` The same plaintext mirror scheme is used throughout the lockfile, including the transitive dependencies. The direct dependency declarations also use version ranges: ```json "dependencies": { "@mi-gpt/miot": "^1.2.2", "dotenv": "^17.3.1" } ``` ### Technical Analysis The lockfile directs npm to retrieve packages over unencrypted HTTP from a third-party mirror. HTTP does not authenticate the package host or protect transport metadata against modification and interception. The included SHA-512 integrity values significantly reduce the chance that modified package bytes will be accepted when the lockfile itself is trusted and strictly enforced. However, the configuration still creates avoidable supply-chain risk: - Package availability and provenance depend on an external mirror. - A modified lockfile can redirect installation to altered content and replace its integrity value. - Workflows that ignore or regenerate the lockfile may resolve floating dependency ranges to different versions. - The `@mi-gpt/miot` dependency receives highly sensitive Xiaomi credentials at runtime, increasing the impact of dependency compromise. No evidence was found that the currently pinned dependency archives are malicious. This finding concerns the insecure source and installation configuration. ### Attack Path 1. A user follows `SKILL.md` and r ...[truncated 1237 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/test-fetch.js:20
Finding: Test Utility Writes Private Voice Conversation Transcripts to Standard Output
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (28)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented behavior goes beyond a simple live voice bridge: it involves logging into a Xiaomi account, reading recent voice history from cloud-backed services, and printing user utterances to stdout. That mismatch materially increases privacy and credential risk because operators may deploy it expecting transient command forwarding, while it can expose historical conversations and account-linked data.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The skill requires high-value credentials in .env, including a Xiaomi account token or password, to log into a user account and control devices. Credential use is functionally necessary for this integration, but it still represents a real security risk because compromise of the host, logs, or misconfigured secret handling could expose account access with potential device-control and privacy consequences.
Content: Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.
复制 .env.example 并填写配置：

bash
cp .env.example .env

编辑 .env 文件：

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · scripts/.mi.json (reported line 1)May include surrounding context.
json
{"mina":{"deviceId":"android_841fa1ed-e704-41ba-9cec-46c73be38b63","userId":"2277466353","passToken":"V1:pwROAesIuzMBPe5slLSsQlxaobuyZH0R3IgkV3uUgKwmaQ813TVZQtlyHOUwVXYws7jW/RyrdYuZTvyhb8z6LUYP4lwQKIB8ZvqxJEhhLn77i1aKdqFmDW4uHvhBLEX7IXva5tZmXyJlrBjKeQnq6AcJCAagkW4nO6cHa2diDrIEOvvGrGeygboxREgJadGlEDHNuI+yCv++jKKkJHDElD89TZNuykdf/PxsxGxY8RH+t0R6gu2mGG4kC1SJClM1myYL3i2ZxCLtNm1lBm3f1qGLiGTjSX4TuaajKBdr2NtoVsd5Uu8ZJG/F+GhyK73rpodmqEsK+JvfBFuVflf9qQ==","did":"小米AI音箱","debug":false,"pass":{"notificationUrl":"","ssecurity":"6BA2OB0M/LyDEPVEPJWoQA==","code":0,"passToken":"V1:pwROAesIuzMBPe5slLSsQlxaobuyZH0R3IgkV3uUgKwmaQ813TVZQtlyHOUwVXYws7jW/RyrdYuZTvyhb8z6LUYP4lwQKIB8ZvqxJEhhLn77i1aKdqFmDW4uHvhB

Known Vulnerable Dependency: axios==1.13.5 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

Category: Supply Chain
Confidence: 92% confidence
Finding: The project includes axios 1.13.5, which static analysis flags with multiple advisories including SSRF/proxy handling and prototype-pollution-related issues. In this skill's context, a bridge that listens to external voice-derived input and communicates with remote services increases the relevance of request-manipulation bugs, especially if untrusted input can influence URLs, headers, or proxy behavior.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

Category: Supply Chain
Confidence: 88% confidence
Finding: form-data 4.0.5 is flagged for CRLF injection via unescaped multipart field names and filenames, which can enable malformed requests or header/body smuggling when attacker-controlled values are included in multipart uploads. If any voice-derived or externally sourced content is later packaged into multipart requests, this could be turned into request manipulation against upstream APIs.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/xiaoai-listen.js (reported line 11)May include surrounding context.
js
import { getMiNA } from "@mi-gpt/miot"; import dotenv from "dotenv"; // 加载 .env 文件 dotenv.config(); // 配置

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill requires sensitive capabilities through environment variables (MI_USER_ID, MI_PASS_TOKEN or MI_PASSWORD, device identifiers) but does not declare any tool scope or permissions boundary. This weakens reviewability and least-privilege controls, making it easier for the skill to access credentials and external services without explicit operator awareness.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill describes continuous listening/polling and cloud-based speech retrieval but does not clearly warn users that voice data and transcripts are collected, transmitted, and processed through Xiaomi cloud services and then forwarded into an AI workflow. This omission undermines informed consent and increases privacy risk, especially in a household smart-speaker setting involving bystanders and potentially sensitive speech.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The example builds a shell command with interpolated response text: exec(... speak "${response}"). If the AI output or upstream voice-derived content contains shell metacharacters, command substitution, or quote-breaking payloads, this can lead to command injection and arbitrary command execution on the host.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This second example repeats the same unsafe pattern by embedding text directly into exec('node ... speak "${text}"'). Because the text may originate from users, assistants, or automations, it creates a straightforward command-injection path unrelated to the core bridge functionality.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Allowing an empty TRIGGER_PREFIX means the listener may process all captured XiaoAi voice messages rather than explicitly addressed commands. In the context of a continuously running bridge tied to cloud voice transcripts, this broadens collection and execution scope, increasing the chance of unintended command handling and privacy exposure.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The full integration example continues to shell-interpolate text in a TTS command, demonstrating the unsafe pattern in the most complete sample likely to be copied into production. Because this bridge processes voice commands and AI responses, it combines multiple untrusted input sources into a shell execution sink.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation explicitly instructs users to supply Xiaomi account credentials and demonstrates access to conversation history, which is privacy-sensitive data. In the context of a voice-command bridge that continuously polls device conversations, failing to include clear privacy, consent, and credential-handling warnings increases the risk of account compromise and unauthorized collection of spoken content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The environment variable example shows sensitive authentication material being stored and used without any warning about secret management, leakage in logs/shell history, or rotation. Because this skill bridges a household voice assistant account to an AI agent, exposure of these values could enable unauthorized device control and access to private conversation data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The identifiers "xiaoai-bridge" and "XiaoAi speaker voice command bridge" suggest a language- or locale-specific assistant integration, but the manifest provides no note that this is optional, user-selected, or region-specific by design. That can create a natural-language policy concern if the skill effectively assumes a specific locale without documented opt-in or justification.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The manifest describes a voice-command bridge that captures XiaoAi messages, converts them into assistant instructions, and replies via TTS. This script instead loads raw Xiaomi account credentials from environment variables and performs an account login to fetch conversation history, which is a broader account-access capability than the stated bridge behavior itself.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script accesses MI_USER_ID, MI_PASS_TOKEN, MI_PASSWORD, and MI_DEVICE_ID directly from the environment, which are sensitive values. There is no comment, docstring, or user-facing disclosure explaining that the skill reads credentials from the local environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script pulls recent XiaoAi conversation history from a remote service and prints user utterances to stdout without any explicit warning, consent prompt, or data-minimization control. In the context of a voice bridge skill, these records can contain sensitive personal commands, household activity, or other private speech data, making silent retrieval and display a privacy risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The listener emits captured voice-command content and original utterances directly to stdout as JSON, which can expose sensitive spoken data to logs, parent processes, shell history wrappers, or other local collectors without any user disclosure or minimization. In this skill’s context, the data comes from continuous background monitoring of a smart speaker, which increases privacy risk because bystanders may not realize their speech is being captured and forwarded.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The lockfile pins package downloads to an HTTP mirror, which removes transport integrity and enables man-in-the-middle tampering of dependency tarballs in transit. Although npm integrity hashes provide some protection, relying on cleartext transport still weakens supply-chain trust, leaks metadata, and can combine dangerously with compromised lockfiles, mirror poisoning, or developer workflows that regenerate the lockfile from the same mirror.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This additional dependency confirms the project is systematically sourcing packages from the same cleartext regional mirror rather than an isolated one-off entry. Broad use of HTTP mirrors increases the attack surface for dependency substitution, interception, and policy drift across the entire install chain.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The repeated use of region-specific HTTP resolved URLs shows the insecure package source choice affects transitive dependencies as well, making the whole dependency graph subject to interception or mirror compromise. In a voice-command bridge that can trigger assistant actions, a supply-chain compromise could become an execution path into a highly privileged automation environment.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)

Low

Category: Supply Chain
Confidence: 84% confidence
Finding: follow-redirects 1.15.11 is flagged for leaking custom authentication headers across cross-domain redirects. If this bridge sends authenticated requests to device, cloud, or TTS/AI endpoints, an attacker controlling a redirect target could capture tokens or session headers and pivot into connected services.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This manifest file describes the skill only as a "voice command bridge" without indicating what phrases, contexts, or boundaries govern activation. In a manifest file, the absence of specific trigger scope can lead to ambiguous or overly broad invocation behavior.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 84% confidence
Finding: Using a caret version for @mi-gpt/miot allows automatic adoption of future minor/patch releases, which can introduce malicious or vulnerable code through the dependency supply chain. In a voice-command bridge that listens in the background and may forward commands to an assistant, a compromised dependency could gain access to audio-derived commands, tokens, or downstream automation flows.
Content: Scanner excerpt · scripts/package.json (reported line 8)May include surrounding context.
json
"type": "module", "main": "xiaoai-listen.js", "dependencies": { "@mi-gpt/miot": "^1.2.2", "dotenv": "^17.3.1" }, "engines": {

Static analysis

No suspicious patterns detected.