ClawHub
Back to skill

Security audit

音色库搜索 ElevenLabs Voice Search

Security checks across malware telemetry and agentic risk

Overview

This appears to be a normal dLazy/ElevenLabs voice-search wrapper, though some copied documentation incorrectly describes image outputs and generic file-upload behavior.

Install only if you are comfortable using the dLazy CLI and sending voice-search terms and filters to dLazy's hosted service. Prefer `npx @dlazy/cli@1.2.3` or an environment variable API key if you do not want a persistent global install or saved key. Treat the image-output and local media-upload text as generic copied documentation, not specific behavior for this search command.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The documented output schema and save semantics describe image-generation style artifacts and downloadable assets, which materially conflicts with the stated purpose of an ElevenLabs voice-library search tool. This mismatch can mislead an agent into handling outputs, files, or downstream automation incorrectly, increasing the chance of unintended file writes, bad tool chaining, or exposing users to behavior they did not authorize.

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The skill claims that local image/video/audio file paths may be uploaded to remote storage as part of tool execution, even though the command is presented as a text-based voice search with filter arguments only. In an agent setting, that discrepancy is dangerous because it broadens the apparent data exfiltration surface and may cause users or orchestrators to underestimate when local files could be transmitted to third-party services.

Intent-Code Divergence

Low
Confidence
90% confidence
Finding
The error table references image/video file read failures for a voice-search command, indicating copy-pasted or inaccurate operational guidance. While lower severity, this can still cause agents and users to misunderstand the command's capabilities and trust boundary, masking when a tool actually reads local files or causing incorrect troubleshooting during execution.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.