mimo-v2-5-tts
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation and script headers specify a requirement for the
openaiPython library to be installed viapip.\n- [COMMAND_EXECUTION]: Local shell commands are used for audio transcribing, conversion, and concatenation viaffmpeg, and for network communication viacurl.\n- [DATA_EXFILTRATION]: Audio data and text context are transmitted to external services, specifically the MiMo synthesis API (api.xiaomimimo.com) and the Feishu messaging platform (open.feishu.cn). These operations are consistent with the skill's stated purpose and target established service providers.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text and control context, creating a vulnerability surface for indirect instructions.\n - Ingestion points: Text, context, and voice file arguments passed to
mimo_tts.py,mimo_tts_voiceclone.py,mimo_tts_voicedesign.py, andfeishu_send_audio.sh.\n - Boundary markers: The Python scripts utilize role-based message separation (user vs. assistant) in the synthesis API calls to differentiate control instructions from the text to be synthesized.\n
- Capability inventory: The skill is capable of reading local files, writing audio files to the disk, and performing external network requests to synthesis and messaging APIs.\n
- Sanitization: Input text and context are interpolated into API messages and command arguments without explicit sanitization or filtering.
Audit Metadata