ClawHub
Back to skill

Security audit

Elevenlabs

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent ElevenLabs text-to-speech skill with expected external API use, but users should treat clinical content and API keys carefully.

Install only if you intend to send approved text to ElevenLabs for audio generation. Do not include PHI or sensitive patient data in prompts or logs unless your organization has approved that third-party processing, and store ELEVENLABS_API_KEY in an environment variable or secret manager rather than directly in config where possible. Treat the README's music section as documentation only unless you separately add runtime music-generation instructions.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:61
Finding

Unpinned Global Installation of Third-Party CLI

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 61 and 271
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

bash
npm i -g clawhub

The documentation also presents the equivalent unpinned alternative:

bash
pnpm add -g clawhub

Technical Analysis

The installation instructions retrieve the latest available version of the third-party clawhub package and install it globally. No reviewed version, package integrity value, lockfile, or other verification mechanism is specified.

Consequently, the installed code may differ from the version that existed when this skill was audited. If the package, publisher account, or package-distribution channel is compromised, a malicious release could execute package lifecycle scripts during installation or provide a malicious CLI afterward.

Global installation increases exposure because the resulting executable is placed in the user's global command environment rather than being isolated to this project.

Attack Path

  1. An attacker compromises the clawhub package, its publisher account, or the relevant package-distribution channel.
  2. The attacker publishes a malicious release under the expected package name.
  3. A user follows the documented npm i -g clawhub or pnpm add -g clawhub instruction.
  4. The package manager resolves the uncontrolled latest release because no version is pinned.
  5. Malicious lifecycle scripts may run during installation, or the installed CLI may execute malicious behavior when invoked.
  6. The payload operates with the permissions of the account running the package manager.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the installing user's privileges. Depending on that user's access, the malicious package could read or modify user-accessible files, environment variables, development credentials, OpenClaw configuration, and project data. It could also replace the globally ...[truncated 281 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin clawhub to a specific version that has been reviewed and tested:
bash
npm install --save-dev clawhub@<reviewed-version>
  • Prefer a project-local installation instead of a global installation so the dependency is isolated and explicitly represented in project metadata.
  • Commit and enforce a lockfile containing the resolved package version and integrity data.
  • Use deterministic package-manager modes such as npm ci in automated environments.
  • Document the expected package registry and reject unexpected registry overrides.
  • Review package provenance, publisher identity, transitive dependencies, and lifecycle scripts before approving version updates.
  • In CI or other sensitive environments, disable package lifecycle scripts when they are unnecessary:
bash
npm ci --ignore-scripts
  • If global installation is operationally required, pin the exact version, verify package provenance or integrity, and perform installation in a restricted environment using a least-privileged account.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

md
- Generate natural, human-like speech from clinical text (discharge instructions, medication reminders, patient education).
- Support **30+ languages** for multilingual patient communication.
- Create **music therapy soundscapes** and background tracks via text-to-music (relaxation, focus, sleep, stress reduction).
- Use low-latency or high-quality models depending on the use case (short reminders vs. long-form content).
- Follow clinical best practices: clear pronunciation, professional tone, and guidance on handling sensitive content and generative media.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The feature description says the skill’s SKILL.md tells the agent when to use TTS, implying a speech-focused instruction set. Later sections document that the skill can guide the agent to use Eleven Music and its compose endpoint, which contradicts the earlier narrower characterization of what the skill instructions cover.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest description limits the skill to converting text to natural speech for healthcare use cases. However, the documentation describes an additional music-generation capability, including Compose Music API usage and music therapy soundscape creation, which is a distinct behavior beyond text-to-speech.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The README instructs the agent to send natural-language prompts to an external ElevenLabs music endpoint, which creates an external data transmission path. In a clinical context, prompts may contain sensitive patient or therapeutic information, so using a third-party API without strict data minimization and consent controls can expose regulated data.

Content

Scanner excerpt · README.md (reported line 203)May include surrounding context.

md
### Music API (high-level)

- **Endpoint (compose):** `POST https://api.elevenlabs.io/v1/music`[2](https://elevenlabs.io/docs/api-reference/music/compose)  
- **Model:** `music_v1` (subject to change; see official docs).  
- **Prompt types:**  
  - Simple natural language prompt (\"calm piano ambient track for relaxation in a hospital room\").

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The README documents direct transmission of clinical text to ElevenLabs text-to-speech using an API key and external endpoint. In healthcare use cases, discharge instructions, medication reminders, or multilingual patient education may contain PHI or sensitive medical context, making third-party transmission a material privacy and compliance risk if not tightly controlled.

Content

Scanner excerpt · README.md (reported line 237)May include surrounding context.

md
Voice IDs are chosen at runtime (by the agent or your tool). You can list available voices via the [ElevenLabs Voices API](https://elevenlabs.io/docs/api-reference/voices) or in the ElevenLabs dashboard. For clinical use, prefer voices that sound clear, calm, and professional.

**API endpoint (reference):**  
`POST https://api.elevenlabs.io/v1/text-to-speech/{voice_id}`  
Headers: `xi-api-key: <ELEVENLABS_API_KEY>`, `Content-Type: application/json`  
Body: `{"text": "<content>", "model_id": "eleven_multilingual_v2"}` (or `eleven_flash_v2_5`).

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill encourages direct use of a third-party TTS API for clinical content without a prominent warning that the provided text is transmitted off-platform to ElevenLabs. In a healthcare context, users may include PHI or sensitive medical instructions, creating a meaningful confidentiality and compliance risk if they are not clearly warned and guided to minimize or avoid such disclosure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The documented endpoint explicitly sends user-provided text to an external ElevenLabs service. In ordinary software this can be expected behavior, but in this clinical skill context it becomes dangerous because patient-facing instructions, discharge summaries, and multilingual health messages may contain PHI or other sensitive clinical data, creating privacy, data handling, and regulatory exposure.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
- Suggest a calm, professional voice for clinical content.

3. **If calling the API directly**  
   - Endpoint: `POST https://api.elevenlabs.io/v1/text-to-speech/{voice_id}`  
   - Headers: `xi-api-key: <ELEVENLABS_API_KEY>`, `Content-Type: application/json`  
   - Body: `{"text": "<content>", "model_id": "eleven_multilingual_v2"}` (or `eleven_flash_v2_5` for low latency).  
   - Prefer **eleven_multilingual_v2** for non-English or mixed-language clinical text.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The description says to use the skill for a wide range of situations such as patient instructions, discharge summaries, medication reminders, multilingual health messages, and accessible voice content, but it does not clearly distinguish when this skill should be used versus ordinary text generation. This breadth may cause unintended invocation for general healthcare writing tasks rather than only explicit text-to-speech requests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.