Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent ElevenLabs voice tool, but it exposes sensitive API credentials in documented debug output and sends voice/audio data to a third-party service without strong privacy or consent warnings.
Review before installing in environments that handle private audio, regulated data, customer recordings, or production API keys. Avoid DEBUG=1 with real ElevenLabs credentials until debug logging is redacted, do not run the scripts or tests from shared writable directories, and only upload or clone voices when you have consent and are comfortable sending the media to ElevenLabs.
scripts/transcribe.sh:116ElevenLabs API Key Disclosed in Debug Output
scripts/speak.sh:191Predictable Temporary Output Files Permit Symlink-Based File Clobbering
test.sh:57Test Suite Uses Shared Predictable Files Under /tmp
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
((TESTS_FAILED++))
fi
fi
rm -f /tmp/test_tts_sample.mp3 /tmp/transcript.txt
fi
# Test 13: Generate sound effect (if not rate limited)
The README encourages speech transcription, voice cloning, isolation, and dubbing workflows that require uploading user audio or video to ElevenLabs, but it does not clearly warn that potentially sensitive media and derived biometric voice data are transmitted to a third-party service. Users may unknowingly submit private conversations, regulated data, or someone else's voice, creating privacy, consent, and compliance risks.
The skill clearly instructs the agent to invoke shell scripts and external commands, but it does not declare any explicit tool scope such as permissions or allowed-tools. That increases the risk of overbroad execution because the hosting platform cannot constrain what command execution capabilities this skill expects or requires.
The transcription, isolation, and dubbing features instruct users to upload audio to a third-party API but do not warn that recordings may contain personal, confidential, or regulated information. This omission can lead users to send sensitive meeting audio, customer data, or private conversations off-device without informed consent or review.
The voice cloning section enables replication of a person's voice without any warning about consent, authorization, impersonation, or biometric privacy concerns. In context, this can facilitate non-consensual cloning, social engineering, fraud, or misuse of sensitive voice data.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
For direct API access, all scripts use curl under the hood:
# Direct TTS API call
The script uploads user-provided audio samples to ElevenLabs for voice cloning, but it does not provide an explicit privacy or third-party data-transfer warning at the point of use. Because voice recordings are biometric and potentially highly sensitive, users may unknowingly transmit personal or third-party data to an external service, creating privacy, consent, and compliance risk.
The script performs an actual POST request to ElevenLabs and uploads local audio files for voice cloning. In the context of voice samples, this is more sensitive than ordinary network use because the transferred data may include biometric identifiers, copyrighted speech, or recordings of third parties, and the script does not gate the transfer with explicit consent or a privacy warning.
START_TIME=$(date +%s)
RESPONSE=$(curl -s -X POST "https://api.elevenlabs.io/v1/voices/add" \
-H "xi-api-key: $API_KEY" \
"${FORM_DATA[@]}" 2>&1) || {
log_error "Failed to connect to ElevenLabs API"
This curl invocation sends request data and an API credential to an external service, which is expected for the feature but still constitutes external data transmission. In a security review of agent skills, this is dangerous because user input may contain sensitive information and the transmission occurs automatically without contextual consent or minimization.
START_TIME=$(date +%s)
TEMP_OUTPUT="${OUTPUT}.tmp.$$"
HTTP_CODE=$(curl -s -w "%{http_code}" -o "$TEMP_OUTPUT" \
-X POST "https://api.elevenlabs.io/v1/sound-generation" \
-H "xi-api-key: $API_KEY" \
-H "Content-Type: application/json" \
The script transmits the user-provided sound-effect description to ElevenLabs over the network, but it does not clearly warn the user at execution time that their prompt content will leave the local environment. In an agent/skill context, users may enter sensitive or proprietary text assuming local processing, so silent exfiltration of prompt contents to a third-party API is a real privacy and data-handling risk.
The hardcoded ElevenLabs endpoint confirms this skill is designed to send content off-host to a third-party SaaS provider. While not inherently malicious, in this skill context it increases exposure because descriptions may contain confidential information and the user is not forced through any explicit privacy acknowledgment before transmission.
TEMP_OUTPUT="${OUTPUT}.tmp.$$"
HTTP_CODE=$(curl -s -w "%{http_code}" -o "$TEMP_OUTPUT" \
-X POST "https://api.elevenlabs.io/v1/sound-generation" \
-H "xi-api-key: $API_KEY" \
-H "Content-Type: application/json" \
-d "$REQUEST" 2>&1) || {
The script transmits user-provided text and the API key to ElevenLabs over the network, but it does not provide an explicit privacy warning or confirmation before sending potentially sensitive content. In a voice/TTS skill this behavior is expected, yet it is still a real privacy/security concern because users may unintentionally submit secrets, personal data, or proprietary text to a third-party service.
This curl call sends the constructed request body, which includes the user's text, to an external ElevenLabs API endpoint. Although this is core to the skill's purpose, it creates a genuine external data exposure path: any sensitive text supplied by the user leaves the local environment and is subject to third-party handling and retention policies.
START_TIME=$(date +%s)
TEMP_OUTPUT="${OUTPUT}.tmp.$$"
HTTP_CODE=$(curl -s -w "%{http_code}" -o "$TEMP_OUTPUT" \
-X POST "https://api.elevenlabs.io/v1/text-to-speech/$VOICE_ID" \
-H "xi-api-key: $API_KEY" \
-H "Content-Type: application/json" \
The hardcoded ElevenLabs API endpoint confirms that this skill depends on sending data to an external service. In context, this is expected functionality rather than covert exfiltration, but it still represents a real privacy boundary crossing because user content is transmitted off-host.
TEMP_OUTPUT="${OUTPUT}.tmp.$$"
HTTP_CODE=$(curl -s -w "%{http_code}" -o "$TEMP_OUTPUT" \
-X POST "https://api.elevenlabs.io/v1/text-to-speech/$VOICE_ID" \
-H "xi-api-key: $API_KEY" \
-H "Content-Type: application/json" \
-d "$REQUEST" 2>&1) || {
This script sends user-supplied audio data to a third-party endpoint at api.elevenlabs.io. In the context of a voice/transcription skill this is expected functionality, but it still creates a genuine data-exfiltration/privacy boundary because potentially sensitive recordings leave the local environment and there is no in-script consent, scoping, or warning mechanism.
log_info "Model: $MODEL"
# Build curl command
CURL_CMD=(curl -s -X POST "https://api.elevenlabs.io/v1/speech-to-text" \
-H "xi-api-key: $API_KEY")
# Build form data
The script uploads the provided audio file to ElevenLabs' external speech-to-text API, but it does not provide an explicit privacy or data-disclosure warning at the point of use. This can cause users to unknowingly transmit sensitive or regulated audio content off-host, which is a real privacy/security issue even if the behavior is consistent with the skill's transcription purpose.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Options for 'delete':
-i, --id <id> Voice ID (required)
--force Skip confirmation
Options for 'preview':
-i, --id <id> Voice ID
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
log_info "Fetching voices..."
RESPONSE=$(curl -s "https://api.elevenlabs.io/v1/voices" \
-H "xi-api-key: $API_KEY") || {
log_error "Failed to connect to ElevenLabs API"
exit 1
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
log_info "Fetching voices..."
RESPONSE=$(curl -s "https://api.elevenlabs.io/v1/voices" \
-H "xi-api-key: $API_KEY") || {
log_error "Failed to connect to ElevenLabs API"
exit 1
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
log_info "Fetching voices..."
RESPONSE=$(curl -s "https://api.elevenlabs.io/v1/voices" \
-H "xi-api-key: $API_KEY") || {
log_error "Failed to connect to ElevenLabs API"
exit 1
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
log_info "Fetching voices..."
RESPONSE=$(curl -s "https://api.elevenlabs.io/v1/voices" \
-H "xi-api-key: $API_KEY") || {
log_error "Failed to connect to ElevenLabs API"
exit 1
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
log_info "Fetching voices..."
RESPONSE=$(curl -s "https://api.elevenlabs.io/v1/voices" \
-H "xi-api-key: $API_KEY") || {
log_error "Failed to connect to ElevenLabs API"
exit 1
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
log_info "Fetching voices..."
RESPONSE=$(curl -s "https://api.elevenlabs.io/v1/voices" \
-H "xi-api-key: $API_KEY") || {
log_error "Failed to connect to ElevenLabs API"
exit 1
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
log_info "Fetching voices..."
RESPONSE=$(curl -s "https://api.elevenlabs.io/v1/voices" \
-H "xi-api-key: $API_KEY") || {
log_error "Failed to connect to ElevenLabs API"
exit 1
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
log_info "Fetching voices..."
RESPONSE=$(curl -s "https://api.elevenlabs.io/v1/voices" \
-H "xi-api-key: $API_KEY") || {
log_error "Failed to connect to ElevenLabs API"
exit 1
No suspicious patterns detected.