mimo-tts
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The
tts.pyscript executes a static system command (chcp 65001) on Windows platforms to set the console output to UTF-8. This is used for character encoding compatibility and does not involve user-controlled input, posing no security risk. - [EXTERNAL_DOWNLOADS]: The documentation references standard Python libraries
numpyandsoundfileas dependencies for streaming audio output. These are well-known, reputable packages in the data science and audio processing ecosystem. - [DATA_EXFILTRATION]: The skill transmits text and audio samples to the MiMo-TTS API endpoints (
api.xiaomimimo.comandapi.mimo-v2.com). This behavior is the primary function of the skill (Speech Synthesis as a Service) and is clearly disclosed to the user. - [CREDENTIALS_UNSAFE]: The skill manages API keys securely by loading them from environment variables or local
.envfiles. There are no hardcoded secrets, and the documentation provides clear instructions for safe credential storage.
Audit Metadata