Security audit

elevenlabs

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent ElevenLabs integration, but it should be reviewed because it can upload local voice samples to create voice clones without clearly surfacing consent and privacy boundaries.

Review this skill before installing if you may use voice cloning. Only clone voices you own or have explicit permission to use, avoid sending confidential text or sensitive audio to ElevenLabs, and keep sample directories narrow so unrelated local files are not accidentally selected.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises and documents use of environment variables, file access, network calls, and shell-executed Python scripts, but the manifest does not declare permissions in a clear, enforceable way. This creates a transparency and policy-enforcement gap: users or hosting platforms may underestimate what the skill can access, increasing the chance of over-privileged execution or unsafe approval.

Description-Behavior Mismatch

Medium

Confidence: 82% confidence
Finding: The top-level description presents the skill as audio generation and voice management, but omits that it supports voice cloning, which is a materially more sensitive capability with impersonation and privacy implications. Hiding or under-describing that behavior can mislead users and reviewers, causing them to enable a higher-risk skill without informed consent.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The documentation claims reads outside a fixed sample directory are blocked, but then immediately documents a --sample-dir option that permits choosing arbitrary directories. This is a contradictory security claim that can cause users and reviewers to assume filesystem restrictions exist when they can be bypassed by normal usage, potentially exposing unintended local files to upload or processing.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: Voice cloning is a high-risk capability because it can enable impersonation, non-consensual voice replication, and processing of sensitive biometric-like voice data. In this skill context, the danger is elevated because the feature is directly operationalized with simple commands, yet the documentation provides no warning about obtaining consent, lawful use, privacy handling, or abuse prevention.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The script transmits arbitrary user-provided text to a third-party service without any explicit warning, consent prompt, or data-classification guard. In agent or automation contexts, that text may contain secrets, personal data, or proprietary content, creating a real privacy and compliance risk even though the transmission is part of the skill's stated function.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: This script uploads local audio samples to an external third-party service for voice cloning, but the CLI does not provide a strong, explicit consent/privacy warning at execution time. Because voice samples are highly sensitive biometric data, users may unknowingly transmit personal or third-party audio off-device, creating privacy, compliance, and consent risk.

Static analysis

No suspicious patterns detected.