Skills/ClawHub/xiaoai-bridge

xiaoai-bridge@1.3.12

CAUTION· install only

Publisher claims: "小米小爱音箱语音指令桥接。截取小爱音箱的语音消息，转换为 AI 助手指令，并通过 TTS 回复。支持触发词过滤、自动去重、后台监听。可选接入 Jev 判定模型（TokenRhythm）作为热词触发的上位替代：配置 JEV_API_KEY 后，全部语音转写文本会发送至 Jev 判定服务（默认 https://tokenrhythm.studio，仅转写文本与能力边界说明，不含账号/设备/凭据）用于转发决策，未配置或服务不可用时自动降级回热词触发。适用于通过小爱音箱语音控制 OpenClaw 助手、智能家居联动、语音任务执行等场景。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher warm-winter · publishing for 23 daysInstalls 1,963Last detonated 7d ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-07 and scored it 76/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Credential pass-through configuration; Credential pass-through configuration. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathsSKILL.md:27 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- scripts/.envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Credential pass-through configurationSKILL.md:155 · Credential pass-through configuration — agent relays sensitive credentials3. **会话缓存**：依赖库 `@mi-gpt/miot` 会把包含 `passToken` / `serviceToken` / `ssecurity` 的 `.mi.json` 写到**进程当前目录**。本 Skill 会在登录前把工作目录切换到私有状态目录，并强制校验：Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationSKILL.md:154 · Credential pass-through configuration — agent relays sensitive credentials2. **优先使用 passToken**：密码登录可能触发验证码，且更容易被风控。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationSKILL.md:164 · Credential pass-through configuration — agent relays sensitive credentials5. **用完即清**：运行 `node scripts/xiaoai-listen.js clean` 删除本地会话缓存（同时清理旧版本可能遗留的 `.mi.json`）。删除本地缓存**不等于撤销凭据**，如怀疑泄露请退出小米账号所有登录并更换 passToken。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationscripts/debug-fetch.js:42 · Credential pass-through configuration — agent relays sensitive credentialsthrow new Error("登录失败：请检查 MI_USER_ID、passToken/密码与 MI_DEVICE_ID");Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationscripts/lib/core.js:7 · Credential pass-through configuration — agent relays sensitive credentials* @mi-gpt/miot 会把包含 passToken / serviceToken 的会话缓存写到Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Access to sensitive file pathsSKILL.md:70 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesdescription: 指定 .env 文件路径，默认 scripts/.env 或技能根目录 .env。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Credential pass-through configurationscripts/lib/core.js:149 · Credential pass-through configuration — agent relays sensitive credentialsconst passToken = String(env.MI_PASS_TOKEN ?? "").trim();Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationSKILL.md:34 · Credential pass-through configuration — agent relays sensitive credentialsdescription: 备选登录方式，可能触发验证码与风控，仅用于无法获取 passToken 时。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Access to sensitive file pathsSKILL.md:67 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesdescription: 仅在权限无法强制/ACL 无法验证时显式放行（存在凭据泄露风险）；必须在进程环境中设置，写在 .env 中会被忽略。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Credential pass-through configurationSKILL.md:151 · Credential pass-through configuration — agent relays sensitive credentials`passToken` 等价于小米账号的登录凭据，能读取设备列表、对话记录并控制音箱。请按以下方式使用：Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationscripts/lib/core.js:151 · Credential pass-through configuration — agent relays sensitive credentialsif (!passToken && !password) {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationscripts/lib/core.js:168 · Credential pass-through configuration — agent relays sensitive credentialspassToken,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Access to sensitive file pathsscripts/lib/env.js:9 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* - `.env` 不得设置安全敏感变量（LOCALAPPDATA/APPDATA/USERPROFILE/HOME/XDG_STATE_HOME、Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Credential pass-through configurationscripts/lib/core.js:152 · Credential pass-through configuration — agent relays sensitive credentialsthrow new ConfigError("缺少 MI_PASS_TOKEN 或 MI_PASSWORD（推荐 passToken，密码登录可能触发安全验证）");Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationscripts/lib/mi-client.js:32 · Credential pass-through configuration — agent relays sensitive credentials* @param {{ userId: string, passToken?: string, password?: string, did: string, debug?: boolean }} configFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Access to sensitive file pathsscripts/lib/env.js:8 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* - `.env` 通常包含 passToken，读取前先做权限检查；可被同组/其他用户修改时直接拒绝。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/lib/env.js:4 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* 加载顺序：`XIAOAI_ENV_FILE`（显式指定）→ 否则 `scripts/.env` → 技能根目录 `.env`。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Credential pass-through configurationscripts/lib/mi-client.js:22 · Credential pass-through configuration — agent relays sensitive credentialspassToken: config.passToken || undefined,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Access to sensitive file pathsscripts/lib/env.js:2 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* `.env` 加载（含权限检查与安全敏感变量隔离）。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Credential pass-through configurationscripts/lib/env.js:8 · Credential pass-through configuration — agent relays sensitive credentials* - `.env` 通常包含 passToken，读取前先做权限检查；可被同组/其他用户修改时直接拒绝。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationscripts/lib/mi-client.js:17 · Credential pass-through configuration — agent relays sensitive credentials* @param {{ userId: string, passToken?: string, password?: string, did: string, debug?: boolean }} configFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
File permission modification commandSKILL.md:558 · File permission modification command — agent changes file ownership/permissions3. POSIX 上修正属主/权限：`chown -R "$(id -u):$(id -g)" <目录>`、`chmod 700 <目录>`；若目录里有其他文件，`chmod` 需要手动执行，程序不会擅自改动；Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandscripts/lib/state.js:7 · File permission modification command — agent changes file ownership/permissions* （包括共享临时目录里被其他用户预先创建的目录），并且在 chmod 失败时静默继续，Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Credential pass-through configurationscripts/lib/redact.js:11 · Credential pass-through configuration — agent relays sensitive credentials* - JSON / 表单里的 passToken、password、serviceToken、ssecurity、nonce 等字段Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
File permission modification commandscripts/lib/state.js:742 · File permission modification command — agent changes file ownership/permissions// 自动 chmod 会影响其它程序，必须由用户自行处理。Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Credential pass-through configurationscripts/xiaoai-listen.js:467 · Credential pass-through configuration — agent relays sensitive credentials"提示：删除本地缓存不等于撤销凭据；如 passToken 可能已泄露，请在小米账号中退出登录并更换 passToken。\n",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationscripts/xiaoai-listen.js:44 · Credential pass-through configuration — agent relays sensitive credentials// 在加载凭据之前先安装脱敏，避免 passToken/serviceToken 进入 stderr。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationscripts/lib/state.js:1213 · Credential pass-through configuration — agent relays sensitive credentials* 环境变量文件（含 passToken）的权限检查与尽力收紧。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationscripts/lib/state.js:1261 · Credential pass-through configuration — agent relays sensitive credentials`⚠️ 环境变量文件权限过宽（${formatMode(stats.mode)}）：${target}，passToken 可被同组或其他用户读取。正在收紧为 0600。`,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
File permission modification commandscripts/lib/state.js:1235 · File permission modification command — agent changes file ownership/permissions`⚠️ 环境变量文件是符号链接：${target}。请确认链接目标仅当前用户可读（chmod 600），否则 passToken 可能泄露。`,Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Credential pass-through configurationscripts/lib/state.js:4 · Credential pass-through configuration — agent relays sensitive credentials* 背景：上游 `@mi-gpt/[email protected]` 在登录成功后把包含 passToken / serviceToken /Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationscripts/xiaoai-listen.js:144 · Credential pass-through configuration — agent relays sensitive credentials"登录失败：请检查 MI_USER_ID、passToken/密码与 MI_DEVICE_ID（DEBUG=true 可打印设备列表）",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationscripts/lib/redact.js:6 · Credential pass-through configuration — agent relays sensitive credentials* `Cookie: userId=...; passToken=...; serviceToken=...`，登录/轮询失败时会把Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationscripts/lib/state.js:1235 · Credential pass-through configuration — agent relays sensitive credentials`⚠️ 环境变量文件是符号链接：${target}。请确认链接目标仅当前用户可读（chmod 600），否则 passToken 可能泄露。`,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
File permission modification commandSKILL.md:202 · File permission modification command — agent changes file ownership/permissionschmod 600 scripts/.env # POSIX 系统建议执行Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandscripts/lib/state.js:746 · File permission modification command — agent changes file ownership/permissions`请把 ${STATE_DIR_ENV_VAR} 指向一个专用目录，或手动执行 chmod 700 "${target}"。`,Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandscripts/lib/state.js:501 · File permission modification command — agent changes file ownership/permissions`拒绝把凭据写入该目录；请改用私有目录，或执行 chown -R ${uid} "${dir}" 修正属主。`,Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandSKILL.md:571 · File permission modification command — agent changes file ownership/permissions请执行 `chmod 600 scripts/.env` 后重试；`.env` 是符号链接时只告警，需自行确认链接目标权限。Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathsscripts/xiaoai-listen.js:78 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesXIAOAI_ENV_FILE 指定 .env 路径，默认 scripts/.env 或技能根目录 .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Credential pass-through configurationscripts/lib/state.js:1352 · Credential pass-through configuration — agent relays sensitive credentialsif (/"(passToken|serviceToken|ssecurity)"/.test(raw)) {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationscripts/xiaoai-listen.js:11 · Credential pass-through configuration — agent relays sensitive credentials* node xiaoai-listen.js clean 清理本地会话缓存（含 passToken）Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationscripts/lib/redact.js:21 · Credential pass-through configuration — agent relays sensitive credentials"passToken|password|serviceToken|yetAnotherServiceToken|ssecurity|psecurity|nonce|MI_PASS_TOKEN|MI_PASSWORD|JEV_API_KEY";Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02

Cost to the agent

Instructions loaded
≈4,619 tok
1 file · 20 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

4 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim warm-winter: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Credential pass-through configuration≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim warm-winterPropose a patch to the maintainer