xiaomi-mimo-tts 安全扫描报告 — 可信 | ClawSafe

5 /100

xiaomi-mimo-tts

使用小米 MiMo TTS (mimo-v2-tts) 生成语音。支持多种音色、风格控制、情感标签和方言。

This is a legitimate Xiaomi MiMo TTS (text-to-speech) skill that calls an external API to synthesize audio from text. Base64 decoding is used solely for decoding returned audio data — a standard and expected pattern. No credential exfiltration, no hidden functionality, no shell obfuscation beyond normal API usage.

技能名称xiaomi-mimo-tts

分析耗时51.3s

引擎pi

✓

可以安装

Approve for use. No security concerns identified. Consider pinning the requests/urllib dependency versions if used in production.

安全发现 2 项

严重性	安全发现	位置
低危	Undeclared DRY variable reference in JavaScript Variable 'DRY' is referenced at line 53 of mimo_tts.js but never defined. Since it evaluates as falsy, the real code path always runs — the block is dead code. This indicates incomplete cleanup from development. `if (DRY) {` → Remove the unreachable DRY block or define 'const DRY = false;' at the top of the file for clarity.	`scripts/base/mimo_tts.js:53`
提示	API key fallback chain not documented The scripts read XIAOMI_API_KEY with fallback to MIMO_API_KEY. This is not documented in SKILL.md, which only mentions XIAOMI_API_KEY. `if [ -z "${XIAOMI_API_KEY}" ] && [ -n "${MIMO_API_KEY}" ]; then` → Document the MIMO_API_KEY fallback in SKILL.md for completeness.	`scripts/_env.sh:10`

资源类型	声明权限	推断权限	状态	证据
文件系统	`WRITE`	`WRITE`	✓ 一致	All implementations write output files (ogg/wav). Declared in SKILL.md (output f…
网络访问	`READ`	`READ`	✓ 一致	HTTPS POST to api.xiaomimimo.com for TTS synthesis. Declared in SKILL.md.
命令执行	`NONE`	`WRITE`	✓ 一致	spawnSync('ffmpeg') and subprocess.run(['ffmpeg']) for audio conversion. Functio…
环境变量	`NONE`	`READ`	✓ 一致	Reads XIAOMI_API_KEY / MIMO_API_KEY — expected credential access for API auth.
技能调用	`NONE`	`NONE`	—	No skill_invoke calls detected.
剪贴板	`NONE`	`NONE`	—	No clipboard access.
浏览器	`NONE`	`NONE`	—	No browser access.
数据库	`NONE`	`NONE`	—	No database access.

2 严重 5 项发现

🔒

严重编码执行 Base64 编码执行（代码混淆）

base64 -d

scripts/base/mimo-tts.sh:58

🔒

严重编码执行 Base64 编码执行（代码混淆）

Buffer.from(audio_b64, 'base64'

scripts/base/mimo_tts.js:81

🔗

中危外部 URL 外部 URL

https://platform.xiaomimimo.com/

README.md:76

🔗

中危外部 URL 外部 URL

https://api.xiaomimimo.com/v1/chat/completions

scripts/base/mimo-tts.sh:54

🔗

中危外部 URL 外部 URL

https://api.xiaomimimo.com/v1/models

scripts/utils/test.sh:31

目录结构

20 文件 · 51.4 KB · 1557 行

Shell 11f · 816L Markdown 3f · 487L Python 2f · 128L JavaScript 2f · 115L JSON 2f · 11L

├─ ▾ 📁 scripts

│ ├─ ▾ 📁 base

│ │ ├─ 📜 mimo_tts.js JavaScript 98L · 3.2 KB

│ │ ├─ 🐍 mimo_tts.py Python 107L · 3.5 KB

│ │ └─ 🔧 mimo-tts.sh Shell 67L · 2.0 KB

│ ├─ ▾ 📁 examples

│ │ ├─ 🔧 demo.sh Shell 65L · 2.2 KB

│ │ ├─ 🔧 dialect-tester.sh Shell 106L · 3.6 KB

│ │ └─ 🔧 tease-generator.sh Shell 86L · 3.8 KB

│ ├─ ▾ 📁 smart

│ │ ├─ 📜 mimo_tts_smart.js JavaScript 17L · 822 B

│ │ ├─ 🐍 mimo_tts_smart.py Python 21L · 889 B

│ │ ├─ 🔧 mimo_tts_smart.sh Shell 109L · 3.0 KB

│ │ └─ 🔧 mimo-tts-smart.sh Shell 88L · 3.0 KB

│ ├─ ▾ 📁 utils

│ │ └─ 🔧 test.sh Shell 65L · 1.5 KB

│ ├─ 🔧 _env.sh Shell 27L · 867 B

│ ├─ 🔧 mimo-tts-smart.sh Shell 96L · 3.3 KB

│ ├─ 🔧 mimo-tts.sh Shell 70L · 2.1 KB

│ └─ 🔧 test_local.sh Shell 37L · 964 B

├─ 📋 _meta.json JSON 5L · 134 B

├─ 📝 CHANGELOG.md Markdown 47L · 2.2 KB

├─ 📋 package.json JSON 6L · 179 B

├─ 📝 README.md Markdown 216L · 7.4 KB

└─ 📝 SKILL.md Markdown 224L · 6.7 KB

依赖分析 3 项

包名	版本	来源	已知漏洞	备注
`ffmpeg`	`any`	system	否	Audio conversion tool. Required for OGG encoding. Declared in usage docs.
`Node.js (fs, child_process, https)`	`any`	system	否	Built-in Node.js modules only.
`Python stdlib`	`any`	stdlib	否	Uses only urllib.request, json, base64, subprocess, os — no pip dependencies.

安全亮点

✓ All network requests go to a single, clearly identified API endpoint (api.xiaomimimo.com) — no suspicious IPs or domains.

✓ Base64 decoding is used exclusively for legitimate TTS audio decoding (API response → audio file), not for obfuscating malicious payloads.

✓ API key access is scoped to authentication for the declared service only — no credential harvesting or exfiltration.

✓ File writes are limited to output audio files in user-specified or temp directories — no writes to sensitive paths like ~/.ssh, ~/.aws, or .env.

✓ No eval(), no os.system/popen with user-controlled strings, no curl|bash patterns.

✓ The skill's functionality is fully declared in SKILL.md: TTS synthesis via Xiaomi MiMo API with style/dialect control.

✓ Python implementation uses standard library only (urllib.request, json, base64, subprocess) — no third-party dependency risk.