ClawHub
Back to skill

Security audit

mimo-v2.5-tts|Xiaomi Official Version

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed cloud text-to-speech skill with optional voice cloning and Feishu message sending, but those features involve sensitive external data sharing.

Install only if you are comfortable sending text, style prompts, and any voice samples to Xiaomi's MiMo API. Use voice cloning only with permission from the voice owner. Keep Feishu credentials least-privileged, and require a clear confirmation of the recipient before any audio is uploaded or sent.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill documents access to environment variables, local file I/O, and shell execution but does not declare corresponding permissions. This weakens review and runtime governance because consumers cannot accurately assess what the skill can access, and those capabilities include secrets and arbitrary command execution paths.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The stated purpose is TTS generation, but the skill also supports transmitting generated audio to Feishu and using Feishu app credentials to obtain tokens and send messages. Hidden or under-declared outbound communication materially changes the trust boundary by sending content and recipient identifiers to an external service.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The activation text includes broad phrases like 'say it out loud' or 'voice reply,' which could cause the skill to trigger in common conversation contexts. Over-broad activation increases the chance of unintended execution, including accidental synthesis or message-sending workflows when users did not intend to invoke this skill.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill offers voice cloning but provides no clear warning about consent, impersonation, biometric privacy, or ownership of source audio. In this context, voice cloning is especially sensitive because it can enable unauthorized mimicry, fraud, or non-consensual processing of a person's voice.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The Feishu section explains how to send generated audio but does not clearly warn that audio content, recipient identifiers, and credentials are used with an external service. Users may not realize that invoking this path causes outbound transmission beyond local synthesis, creating privacy and data-handling risk.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The script uploads a locally provided audio file to Feishu and sends it as a message without any confirmation, warning, or policy gate in the script itself. In an agent-skill context, this can cause unintended disclosure of sensitive spoken content or generated speech to an external recipient if the skill is triggered implicitly or with attacker-influenced parameters.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The script transmits user-provided text and optional style/context instructions to a third-party remote TTS service, but it provides no explicit notice, consent mechanism, or safeguards for sensitive content. In a skill that may be used to read arbitrary user content aloud, this creates a real privacy risk because users or integrators may unknowingly send confidential data off-device.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The script base64-encodes a local voice sample and sends it to a third-party API for cloning, but it provides no explicit user-facing disclosure or consent check at the point of transfer. Because voice samples are biometric and highly sensitive, undisclosed external transmission increases privacy and compliance risk, especially if this skill is invoked indirectly by another agent or workflow.

External Transmission

Medium
Category
Data Exfiltration
Content
# ── Step 4: 发送语音消息 ─────────────────────────────────

RESULT=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=$RECEIVE_ID_TYPE" \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d "{\"receive_id\":\"$FEISHU_RECEIVE_ID\",\"msg_type\":\"audio\",\"content\":\"{\\\"file_key\\\":\\\"$FILE_KEY\\\"}\"}")
Confidence
92% confidence
Finding
curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=$RECEIVE_ID_TYPE" \ -H "Authorization: Bearer $TOKEN" \ -H 'Content-Type: application/json' \ -d

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.