MiMo 联网搜索

基于小米 MiMo 模型提供实时联网搜索，支持最新信息查询与资料核对，需配置 API Key 并付费使用。

Key things to consider before installing: - Metadata mismatch: the registry advertises no required env vars but both SKILL.md and index.js require MIMO_API_KEY. Ask the publisher to update the registry entry so the required credential is explicit (primaryEnv should be MIMO_API_KEY). - Shell injection risk: the implementation builds and runs a curl command via child_process.exec with the query embedded in JSON without proper escaping. Malicious or accidental input could break the command and enable injection. Prefer using an in-process HTTP client (fetch/axios/https.request) or securely escape inputs before using exec. - Verify the API endpoint and publisher: source/homepage are missing. Confirm api.xiaomimimo.com is the legitimate MiMo API endpoint and that you trust the publisher before providing an API key. - Costs and tests: test.js and examples will make live API calls and incur charges. Only run tests with a valid (and limited) API key and in an environment where you accept the billing risk. - Mitigations: update the package/registry metadata to declare MIMO_API_KEY, replace shell exec with a safe HTTP client or properly escape inputs, and limit the API key's scope/permissions where possible. If you cannot validate the endpoint or publisher, avoid installing or provide a restricted key.

Type: OpenClaw Skill Name: mimo-web-search Version: 1.0.1 The skill contains a critical shell injection vulnerability in index.js. It uses child_process.exec to execute a curl command where the user-provided query is included in a JSON payload wrapped in single quotes. Because JSON.stringify does not escape single quotes, a crafted query (e.g., containing '; command ;) can break out of the shell string and execute arbitrary commands on the host. While the skill appears to be a legitimate tool for the MiMo search API (api.xiaomimimo.com), the unsafe handling of user input makes it highly vulnerable to exploitation.