← xiaoai-bridge@1.3.9
Propose a patch
A fix the maintainer can act on, with the evidence attached. It opens under your GitHub account in your browser; KillerSkills holds no token and never modifies the package. The fix is verified the only way we verify anything: the next crawl re-runs the new version in the honeypot. 76 · Caution
Evidence
The sandbox observed nothing beyond the static findings; the proposal cites those.
Diff · removes 27 caught lines
Download .patchdiff --git a/SKILL.md b/SKILL.md
--- a/SKILL.md
+++ b/SKILL.md
@@ -28,1 +28,0 @@
-description: 备选登录方式，可能触发验证码与风控，仅用于无法获取 passToken 时。
@@ -145,1 +144,0 @@
-`passToken` 等价于小米账号的登录凭据，能读取设备列表、对话记录并控制音箱。请按以下方式使用：
@@ -148,1 +146,0 @@
-2. **优先使用 passToken**：密码登录可能触发验证码，且更容易被风控。
@@ -149,1 +146,0 @@
-3. **会话缓存**：依赖库 `@mi-gpt/miot` 会把包含 `passToken` / `serviceToken` / `ssecurity` 的 `.mi.json` 写到**进程当前目录**。本 Skill 会在登录前把工作目录切换到私有状态目录，并强制校验：
@@ -158,1 +154,0 @@
-5. **用完即清**：运行 `node scripts/xiaoai-listen.js clean` 删除本地会话缓存（同时清理旧版本可能遗留的 `.mi.json`）。删除本地缓存**不等于撤销凭据**，如怀疑泄露请退出小米账号所有登录并更换 passToken。
diff --git a/scripts/lib/core.js b/scripts/lib/core.js
--- a/scripts/lib/core.js
+++ b/scripts/lib/core.js
@@ -7,1 +7,0 @@
-* @mi-gpt/miot 会把包含 passToken / serviceToken 的会话缓存写到
@@ -149,1 +148,0 @@
-const passToken = String(env.MI_PASS_TOKEN ?? "").trim();
@@ -151,1 +149,0 @@
-if (!passToken && !password) {
@@ -152,1 +149,0 @@
-throw new ConfigError("缺少 MI_PASS_TOKEN 或 MI_PASSWORD（推荐 passToken，密码登录可能触发安全验证）");
@@ -168,1 +164,0 @@
-passToken,
diff --git a/scripts/debug-fetch.js b/scripts/debug-fetch.js
--- a/scripts/debug-fetch.js
+++ b/scripts/debug-fetch.js
@@ -42,1 +42,0 @@
-throw new Error("登录失败：请检查 MI_USER_ID、passToken/密码与 MI_DEVICE_ID");
diff --git a/scripts/lib/mi-client.js b/scripts/lib/mi-client.js
--- a/scripts/lib/mi-client.js
+++ b/scripts/lib/mi-client.js
@@ -17,1 +17,0 @@
-* @param {{ userId: string, passToken?: string, password?: string, did: string, debug?: boolean }} config
@@ -22,1 +21,0 @@
-passToken: config.passToken || undefined,
@@ -32,1 +30,0 @@
-* @param {{ userId: string, passToken?: string, password?: string, did: string, debug?: boolean }} config
diff --git a/scripts/xiaoai-listen.js b/scripts/xiaoai-listen.js
--- a/scripts/xiaoai-listen.js
+++ b/scripts/xiaoai-listen.js
@@ -11,1 +11,0 @@
-* node xiaoai-listen.js clean 清理本地会话缓存（含 passToken）
@@ -44,1 +43,0 @@
-// 在加载凭据之前先安装脱敏，避免 passToken/serviceToken 进入 stderr。
@@ -144,1 +142,0 @@
-"登录失败：请检查 MI_USER_ID、passToken/密码与 MI_DEVICE_ID（DEBUG=true 可打印设备列表）",
@@ -467,1 +464,0 @@
-"提示：删除本地缓存不等于撤销凭据；如 passToken 可能已泄露，请在小米账号中退出登录并更换 passToken。\n",
diff --git a/scripts/lib/state.js b/scripts/lib/state.js
--- a/scripts/lib/state.js
+++ b/scripts/lib/state.js
@@ -4,1 +4,0 @@
-* 背景：上游 `@mi-gpt/[email protected]` 在登录成功后把包含 passToken / serviceToken /
@@ -1123,1 +1122,0 @@
-* 环境变量文件（含 passToken）的权限检查与尽力收紧。
@@ -1145,1 +1143,0 @@
-`⚠️ 环境变量文件是符号链接：${target}。请确认链接目标仅当前用户可读（chmod 600），否则 passToken 可能泄露。`,
@@ -1171,1 +1168,0 @@
-`⚠️ 环境变量文件权限过宽（${formatMode(stats.mode)}）：${target}，passToken 可被同组或其他用户读取。正在收紧为 0600。`,
@@ -1262,1 +1258,0 @@
-if (/"(passToken|serviceToken|ssecurity)"/.test(raw)) {
diff --git a/scripts/lib/redact.js b/scripts/lib/redact.js
--- a/scripts/lib/redact.js
+++ b/scripts/lib/redact.js
@@ -6,1 +6,0 @@
-* `Cookie: userId=...; passToken=...; serviceToken=...`，登录/轮询失败时会把
@@ -11,1 +10,0 @@
-* - JSON / 表单里的 passToken、password、serviceToken、ssecurity、nonce 等字段
@@ -21,1 +19,0 @@
-"passToken|password|serviceToken|yetAnotherServiceToken|ssecurity|psecurity|nonce|MI_PASS_TOKEN|MI_PASSWORD|JEV_API_KEY";
diff --git a/scripts/lib/env.js b/scripts/lib/env.js
--- a/scripts/lib/env.js
+++ b/scripts/lib/env.js
@@ -8,1 +8,0 @@
-* - `.env` 通常包含 passToken，读取前先做权限检查；可被同组/其他用户修改时直接拒绝。
Zero-context hunks: apply with git apply --unidiff-zero fix.patch on the tagged source of 1.3.9. If the behavior is intended, declare it (host under permissions.network, a line in the README) instead of removing it; the next crawl scores declarations.
Issue / PR body
Title: xiaoai-bridge: Credential pass-through configuration (KillerSkills verdict caution 76)
## What the honeypot observed KillerSkills ran **[email protected]** in an isolated sandbox (decoy credentials, recording proxy, syscall trace; engine 1.8.1) and scored it **CAUTION 76/100**. Summary: no network, touches nothing outside the project, writes no memory. - See the findings below. Full trace and findings: https://killerskills.ai/skills/clawhub/xiaoai-bridge/1.3.9 ## Findings with a location - `SKILL.md:158` · Credential pass-through configuration — SKILL.md:158 · Credential pass-through configuration — agent relays sensitive credentials - `scripts/lib/core.js:151` · Credential pass-through configuration — scripts/lib/core.js:151 · Credential pass-through configuration — agent relays sensitive credentials - `scripts/lib/core.js:152` · Credential pass-through configuration — scripts/lib/core.js:152 · Credential pass-through configuration — agent relays sensitive credentials - `SKILL.md:148` · Credential pass-through configuration — SKILL.md:148 · Credential pass-through configuration — agent relays sensitive credentials - `scripts/lib/core.js:149` · Credential pass-through configuration — scripts/lib/core.js:149 · Credential pass-through configuration — agent relays sensitive credentials - `scripts/lib/core.js:7` · Credential pass-through configuration — scripts/lib/core.js:7 · Credential pass-through configuration — agent relays sensitive credentials - `SKILL.md:145` · Credential pass-through configuration — SKILL.md:145 · Credential pass-through configuration — agent relays sensitive credentials - `SKILL.md:149` · Credential pass-through configuration — SKILL.md:149 · Credential pass-through configuration — agent relays sensitive credentials - `scripts/debug-fetch.js:42` · Credential pass-through configuration — scripts/debug-fetch.js:42 · Credential pass-through configuration — agent relays sensitive credentials - `SKILL.md:28` · Credential pass-through configuration — SKILL.md:28 · Credential pass-through configuration — agent relays sensitive credentials - `scripts/lib/core.js:168` · Credential pass-through configuration — scripts/lib/core.js:168 · Credential pass-through configuration — agent relays sensitive credentials - `scripts/lib/mi-client.js:22` · Credential pass-through configuration — scripts/lib/mi-client.js:22 · Credential pass-through configuration — agent relays sensitive credentials ## Proposed change The attached patch removes the 27 lines above. If the behavior is intended, the fix is to declare it instead: list the host under `permissions.network` (or the MCP manifest) and say in the README why the package needs it; the next crawl will re-score it with the declaration taken into account. ## How this will be verified Nothing is "verified safe" by assertion. When a new version is published, KillerSkills re-runs it in the honeypot and the verdict page updates; you can trigger it early from the verdict page ("Re-scan after I publish a fix"). Reply here or at [email protected] if you believe the verdict is wrong; disputes are reviewed by a person and the outcome is published on the verdict page. _Proposed through killerskills.ai/threats by a user of the package, under their own GitHub account. The evidence is public; the package was never modified by KillerSkills._
# or from a terminal, under your own account: gh repo fork idootop/migpt-next --clone && cd migpt-next curl -s https://killerskills.ai/skills/clawhub/xiaoai-bridge/1.3.9/patch.diff | git apply --unidiff-zero git checkout -b killerskills/1.3.9 && git commit -am "xiaoai-bridge: Credential pass-through configuration" gh pr create --fill --body-file <(curl -s https://killerskills.ai/skills/clawhub/xiaoai-bridge/1.3.9/patch.md)
We count proposals opened, not merged: a merge shows up as a new version that the crawl re-runs. Disputes: the maintainer can contest the verdict from its page; a person reviews it and the outcome is published.