ClawHub
Back to skill

Security audit

WhatsApp Voice Note

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to do what it says: create and send WhatsApp voice notes, with clear caveats around recipient control and cloud text-to-speech privacy.

Install only if you want an agent that can send WhatsApp voice notes. Configure a clear recipient allowlist or confirmation rule, use --dry-run or --out-only for testing, and avoid ElevenLabs for sensitive message text unless you are comfortable sending that text to the TTS provider.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · voice.sh (reported line 18)May include surrounding context.

sh
#   voice.sh --target +15555550100 --text-file /path/to/note.txt
#   voice.sh --text "..." --out-only /tmp/foo.ogg                        # build file, don't send
#
# ElevenLabs config (skill .env or env vars):
#   ELEVENLABS_API_KEY   — required to use ElevenLabs
#   ELEVENLABS_VOICE_ID  — male multilingual voice id (default: Daniel onwK4e9ZLuTAKqWW03F9)
#   ELEVENLABS_MODEL     — default eleven_multilingual_v2 (best quality; supports Hebrew).

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · voice.sh (reported line 28)May include surrounding context.

sh
#   voice.sh --target +15555550100 --text-file /path/to/note.txt
#   voice.sh --text "..." --out-only /tmp/foo.ogg                        # build file, don't send
#
# ElevenLabs config (skill .env or env vars):
#   ELEVENLABS_API_KEY   — required to use ElevenLabs
#   ELEVENLABS_VOICE_ID  — male multilingual voice id (default: Daniel onwK4e9ZLuTAKqWW03F9)
#   ELEVENLABS_MODEL     — default eleven_multilingual_v2 (best quality; supports Hebrew).

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · voice.sh (reported line 30)May include surrounding context.

sh
SKILL_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# Load .env as DEFAULTS only — never clobber a var already set in the environment,
# so `ELEVENLABS_MODEL=... voice.sh` and exported overrides still win.
if [[ -f "$SKILL_DIR/.env" ]]; then
  while IFS='=' read -r k v; do
    [[ "$k" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]] || continue
    [[ -n "${!k:-}" ]] && continue

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · voice.sh (reported line 35)May include surrounding context.

sh
SKILL_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# Load .env as DEFAULTS only — never clobber a var already set in the environment,
# so `ELEVENLABS_MODEL=... voice.sh` and exported overrides still win.
if [[ -f "$SKILL_DIR/.env" ]]; then
  while IFS='=' read -r k v; do
    [[ "$k" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]] || continue
    [[ -n "${!k:-}" ]] && continue

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill advertises and instructs shell-based behavior that can send WhatsApp messages and access environment variables, but it declares no explicit tool scope or permissions boundary. In an agent environment, that omission can let the skill be invoked with broader-than-necessary execution privileges, increasing the chance of unauthorized messaging, secret exposure, or misuse of local shell capabilities.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The activation text is broad enough to trigger on generic requests like 'reply by voice' or 'read something out loud to a chat,' which can cause unintended invocation of a skill that sends external messages. Because this skill performs an outbound action to WhatsApp, accidental activation could result in messages being sent to the wrong party or without sufficient user confirmation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · voice.sh (reported line 96)May include surrounding context.

sh
MP3="$TMP/voice.mp3"
  # Build JSON body safely (text may contain quotes / Hebrew / newlines).
  BODY="$(MODEL="$MODEL" TEXT="$TEXT" python3 -c 'import json,os;print(json.dumps({"text":os.environ["TEXT"],"model_id":os.environ["MODEL"],"voice_settings":{"stability":0.5,"similarity_boost":0.8}}))')"
  code=$(curl -sS -o "$MP3" -w "%{http_code}" \
    "https://api.elevenlabs.io/v1/text-to-speech/${VOICE_ID}" \
    -H "xi-api-key: ${ELEVENLABS_API_KEY}" -H "Content-Type: application/json" \
    --data "$BODY")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

When the ElevenLabs engine is used, the script sends the provided message text to a third-party TTS service over HTTP. Although the comments mention the engine and API key, there is no runtime confirmation prompt or explicit user-facing disclosure that message content will leave the local system.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · voice.sh (reported line 97)May include surrounding context.

sh
# Build JSON body safely (text may contain quotes / Hebrew / newlines).
  BODY="$(MODEL="$MODEL" TEXT="$TEXT" python3 -c 'import json,os;print(json.dumps({"text":os.environ["TEXT"],"model_id":os.environ["MODEL"],"voice_settings":{"stability":0.5,"similarity_boost":0.8}}))')"
  code=$(curl -sS -o "$MP3" -w "%{http_code}" \
    "https://api.elevenlabs.io/v1/text-to-speech/${VOICE_ID}" \
    -H "xi-api-key: ${ELEVENLABS_API_KEY}" -H "Content-Type: application/json" \
    --data "$BODY")
  if [[ "$code" != "200" ]]; then