小米tts文字转语音

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:00 AM UTC
• Version: 1.0.0

Overview

This skill is a small text-to-speech helper whose network use is aligned with its purpose, but users should understand that text and an API key are sent to an external MiMo service.

Install only if you are comfortable sending the text you ask it to synthesize, plus a MiMo API credential, to the external MiMo/Xiaomi TTS service. Avoid using it for secrets, private personal data, regulated data, or text you would not want processed by that provider, and be aware it may read a MiMo key from ~/.openclaw/config.json if no key is passed explicitly.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill appears to require environment access for `MIMO_API_KEY` and network access to an external TTS service, but it does not declare any tool scope or permissions. Undeclared capabilities make review and runtime containment harder, and can cause users or orchestrators to invoke a networked skill without understanding its external access requirements.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The description includes broad everyday trigger phrases like '发语音、念给我听、唱歌、用方言或夹子音说话', which can cause overly eager activation in normal conversation. In an agent ecosystem, ambiguous activation increases the chance that user text is sent to the TTS workflow unintentionally, especially when the skill also relies on a remote service.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README instructs users to synthesize text via an external TTS API and notes use of an API key, but it does not clearly warn that the provided text will be transmitted off-system. This creates a privacy and data-handling risk because users may submit sensitive content assuming processing is local.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The file’s natural-language documentation and CLI usage strings are entirely in Chinese, and later error/output messages are also Chinese-only. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified, which is not present here.

External Transmission

Medium

• Category: Data Exfiltration

Content

import { parseArgs } from "node:util";
import { homedir } from "node:os";

const API_URL = "https://api.xiaomimimo.com/v1/chat/completions";
const MODEL = "mimo-v2-tts";
const DEFAULT_VOICE = "default_zh";

• Confidence: 89% confidence
• Finding: The script sends user-supplied text and an API credential to an external third-party endpoint for speech synthesis. In the context of a TTS skill this behavior is expected, but it still creates a real data-exposure boundary because any text provided, including sensitive content, leaves the local environment and is processed by an external service.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The manifest describes a text-to-speech capability, where network access to a TTS API is expected. However, reading `~/.openclaw/config.json` to discover credentials reaches into unrelated user configuration state and is not an obvious requirement from the stated purpose alone.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/xiaomi-tts.js:18