MoodCast

ReviewAudited by ClawScan on May 10, 2026.

Overview

MoodCast’s text-to-audio purpose is coherent, but it can automatically install an unpinned Python dependency at runtime and uses an ElevenLabs API key to send user text to an external service.

Review this skill before installing. Its main function appears legitimate, but install the dependency yourself from a trusted, pinned version if possible, use a dedicated ElevenLabs API key, and avoid sending sensitive text you do not want processed by ElevenLabs.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Running the skill may cause new third-party Python code to be downloaded and installed before generating audio.

Why it was flagged

If the dependency is missing, the script automatically downloads and installs the ElevenLabs package at runtime. This is purpose-related, but it is under-disclosed by the missing install spec and uses an unpinned package source.

Skill content

except ImportError:
    print("Installing elevenlabs package...")
    subprocess.check_call([sys.executable, "-m", "pip", "install", "elevenlabs", "-q"])

Recommendation

Remove the runtime auto-install, declare the dependency in the install spec, and pin the package version or use a lockfile so users can approve and reproduce the dependency.

Low

#ASI03: Identity and Privilege Abuse

What this means

The agent can make ElevenLabs API calls using your configured key, which may consume credits or quota.

Why it was flagged

The skill requires a third-party provider credential. This is expected for ElevenLabs audio generation, but it gives the skill access to use the user's ElevenLabs account and credits.

Skill content

- `ELEVENLABS_API_KEY` (required) - Your ElevenLabs API key

Recommendation

Use a dedicated, revocable API key with the minimum needed access and monitor ElevenLabs usage.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Any text you ask MoodCast to narrate may be sent to ElevenLabs for processing.

Why it was flagged

The script sends the supplied text to ElevenLabs for text-to-speech conversion. This is central to the skill, but it means user-provided content leaves the local environment.

Skill content

client.text_to_speech.convert(text=text, voice_id=voice_id, model_id=model_id, output_format=output_format)

Recommendation

Avoid submitting confidential text unless you are comfortable with ElevenLabs processing it under their terms and privacy policy.