ClawHub
Back to skill

Security audit

ElevenLabs Phone Reminder (Lite)

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward setup guide, but it normalizes sharing powerful Twilio credentials with ElevenLabs and placing outbound AI calls without enough consent, revocation, or cost guidance.

Review this carefully before installing or following it. Use a dedicated Twilio subaccount or restricted credentials if possible, understand that the Twilio token is shared with ElevenLabs, rotate or revoke credentials after testing, and only call recipients who have explicitly agreed to receive AI calls. Check applicable call recording, robocall, telemarketing, privacy, and billing rules for your region before production use.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill promotes outbound AI phone calls and real-time conversations without any warning about recipient consent, call recording/privacy obligations, carrier rules, or unexpected telephony charges. That omission can lead users to deploy calling workflows that violate law or policy, expose personal data, or generate unauthorized costs.

External Transmission

Medium
Category
Data Exfiltration
Content
### Step 3: Create ElevenLabs Agent

```bash
curl -X POST "https://api.elevenlabs.io/v1/convai/agents/create" \
  -H "xi-api-key: $ELEVENLABS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
### Step 3: Create ElevenLabs Agent

```bash
curl -X POST "https://api.elevenlabs.io/v1/convai/agents/create" \
  -H "xi-api-key: $ELEVENLABS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The guide explicitly instructs users to send their Twilio Account SID and Auth Token to ElevenLabs to link a phone number, but it does not warn that this shares highly privileged telecom credentials with a separate third party. If those credentials are mishandled, over-scoped, or later compromised, an attacker or service misuse could place calls, access account resources, and incur charges on the user's Twilio account.

External Transmission

Medium
Category
Data Exfiltration
Content
### Step 4: Connect Twilio to ElevenLabs

```bash
curl -X POST "https://api.elevenlabs.io/v1/convai/phone-numbers/create" \
  -H "xi-api-key: $ELEVENLABS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
94% confidence
Finding
This request transmits Twilio SID and Auth Token to ElevenLabs, creating a direct third-party secret-sharing path for credentials that can control telephony resources and billing. The danger is elevated because the example normalizes sending those secrets without explaining scope, revocation, or the consequences of compromise.

External Transmission

Medium
Category
Data Exfiltration
Content
### Step 5: Make a Call!

```bash
curl -X POST "https://api.elevenlabs.io/v1/convai/twilio/outbound-call" \
  -H "xi-api-key: $ELEVENLABS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
88% confidence
Finding
The outbound-call example triggers real phone calls to a recipient number without embedding any safety guidance around consent, identity disclosure, rate limits, or cost exposure. In this skill's context, initiating AI calls is the core action, so the absence of safeguards makes misuse and accidental policy violations more likely.

Static analysis

No suspicious patterns detected.