小米 MiMo TTS

Text-to-speech using Xiaomi MiMo TTS API. Generates WAV audio files. Triggers when user says "send voice message", "voice reply", "read to me", "use clip voi...

This package appears to implement the described MiMo TTS functionality, but there are two mismatches you should consider before installing: (1) the script requires an API key (MIMO_API_KEY) but the skill metadata declares no required env vars — ask the publisher to add MIMO_API_KEY to requires.env so it's explicit; (2) the script will try to read ~/.openclaw/config.json to find the key if the env var is not set — verify you are comfortable with the skill reading that config file (it loads the whole JSON). Additional checks: confirm the API endpoint (https://api.xiaomimimo.com) is legitimate for the provider, inspect the code yourself (it’s short) to ensure it only sends the text you provide and the key, and prefer providing the API key explicitly in a controlled place rather than leaving it in shared config. If the publisher updates the manifest to declare the required env var and documents the config-file lookup, and you verify the remote endpoint is legitimate, the mismatch concern would be resolved.

Type: OpenClaw Skill Name: mimo-tts Version: 1.0.2 The skill provides text-to-speech functionality via a third-party API (api.xiaomimimo.com). The script 'scripts/mimo_tts.py' exhibits risky capabilities, including reading the platform's configuration file (~/.openclaw/config.json) to extract API keys and writing binary data to arbitrary filesystem paths provided via the '--output' argument. While these behaviors are plausibly needed for the stated purpose, the lack of path sanitization and the access to sensitive configuration files represent a significant attack surface for prompt injection or unauthorized file modification.