Security audit

Voice Agent Pro

Security checks for vulnerabilities and agentic risk

Overview

This voice-cloning and calling skill is mostly disclosed, but it asks for broad credentials and persistent access beyond the implemented code and stores sensitive API keys in plaintext.

Review before installing. Use only with explicit consent from the voice owner, understand that voice samples are uploaded to ElevenLabs, avoid granting Telegram/Twilio credentials unless you are enabling calls or notifications, and prefer scoped secrets or a protected secret store over plaintext config.json or broad .env access.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T08 · Insecure Dependencies

Error

Location: SKILL.md:76
Finding: Unpinned dependencies installed into the system Python environment
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: voice_generator.py:36
Finding: ElevenLabs API credentials are persisted in a plaintext workspace file
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: voice_generator.py:141
Finding: Predictable shared temporary files permit symlink attacks and cross-run corruption
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:20
Finding: Skill metadata requests secrets and persistent workspace access beyond implemented functionality
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (59)

Tainted flow: 'req' from os.environ.get (line 325, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · voice_generator.py (reported line 329)May include surrounding context.
python
"https://api.elevenlabs.io/v1/user", headers={"xi-api-key": key} ) with urllib.request.urlopen(req, timeout=10) as resp: import json data = json.loads(resp.read()) plan = data.get("subscription", {}).get("tier", "unknown")

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The document promises voice cloning and calling features, but much of the behavior is only described procedurally and includes credential-writing and API verification flows not cleanly reflected in the declared purpose. This mismatch makes review difficult and can conceal risky actions such as modifying local config with secrets and contacting third-party services under the guise of a content-generation skill.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 91% confidence
Finding: The skill explicitly directs use of secrets from .env for ElevenLabs credentials, showing it expects credential access during execution. Access to environment-stored secrets is sensitive because the same agent context may hold unrelated tokens, and voice/Twilio workflows can chain that access into external transmission.
Content: Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.
text
LAYER 1 — VOICE SETUP Clones the principal's voice from MP3 samples via ElevenLabs API Requires ELEVENLABS_API_KEY and ELEVENLABS_VOICE_ID in .env Full setup guide with all commands: references/setup_guide.md LAYER 2 — TEXT TO SPEECH

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: This section instructs operators to place the ElevenLabs API key in the agent .env, making the secret broadly available to any process with environment access. In combination with shell and network capabilities, that increases the chance of credential leakage or misuse.
Content: Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.
OPTION B — Manual (recommended for first setup) → Go to: https://elevenlabs.io/app/settings/api-keys → Click "Create API Key" → name it → copy it → Add to your agent .env file: ELEVENLABS_API_KEY=sk_...

text
```bash

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.
print("✅ Voice ID saved to config.json")

text
#### Via curl ```bash VOICE_ID=$(curl -s -X POST https://api.elevenlabs.io/v1/voices/add \

Credential Access

High

Category: Privilege Escalation
Confidence: 91% confidence
Finding: Twilio account SID, auth token, and phone number are placed in the shared .env, exposing high-value telephony credentials to the agent context. If misused, these credentials could enable unauthorized calls, message sending, billing abuse, or access to call records.
Content: Scanner excerpt · SKILL.md (reported line 301)May include surrounding context.
Setup Twilio

bash
# Add to your agent .env file: TWILIO_ACCOUNT_SID=ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx TWILIO_AUTH_TOKEN=your_auth_token TWILIO_PHONE_NUMBER=+1234567890

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 397)May include surrounding context.
md
→ Multiple speakers in same file Solution: → Delete the bad clone: curl -X DELETE https://api.elevenlabs.io/v1/voices/$VOICE_ID \ -H "xi-api-key: $ELEVENLABS_API_KEY" → Record better samples (quieter, longer, more natural) → Re-run cloning

Credential Access

High

Category: Privilege Escalation
Confidence: 84% confidence
Finding: The troubleshooting step again relies on .env-managed API secrets and normalizes environment-wide credential storage for operational recovery. Repeated instructions to manipulate or depend on .env increase the likelihood of accidental disclosure, overbroad access, and secret sprawl.
Content: Scanner excerpt · SKILL.md (reported line 410)May include surrounding context.
md
PROBLEM: "Invalid API key" (401 on all requests) Solution: Regenerate at https://elevenlabs.io/app/settings/api-keys Update .env and restart agent container PROBLEM: ffmpeg not found Solution: apt-get update && apt-get install -y ffmpeg

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: By documenting a raw DELETE /v1/voices/{id} capability, the skill exposes a destructive parameterized action that could remove arbitrary voice assets if the ID is mishandled or maliciously substituted. In a system centered on cloned-voice assets, insufficient validation or confirmation around such operations can cause data loss or service disruption.
Content: Scanner excerpt · SKILL.md (reported line 428)May include surrounding context.
GET /v1/user → account + subscription info GET /v1/voices → list all voices POST /v1/voices/add → create IVC clone (multipart form) DELETE /v1/voices/{id} → delete a voice POST /v1/text-to-speech/{id} → generate audio (JSON body) GET /v1/models → list available models

text

Credential Access

High

Category: Privilege Escalation
Confidence: 93% confidence
Finding: The skill notes that Telegram bot credentials already exist in the agent .env, implying access to messaging secrets that may be unrelated to voice generation. This broadens blast radius: compromise or misuse of the skill could pivot into unauthorized Telegram notifications or data exfiltration.
Content: Scanner excerpt · SKILL.md (reported line 451)May include surrounding context.
TWILIO_PHONE_NUMBER → buy a number on Twilio (~$1/month)

AGENT ALREADY HAS: TELEGRAM_BOT_TOKEN → already in your agent .env TELEGRAM_CHAT_ID → already in your agent .env

text

Credential Access

High

Category: Privilege Escalation
Confidence: 93% confidence
Finding: Referencing TELEGRAM_CHAT_ID in the shared environment reinforces that the skill expects access to messaging destination metadata in addition to bot tokens. Coupled with transcript and lead handling, this can enable silent forwarding of sensitive summaries outside the local workspace.
Content: Scanner excerpt · SKILL.md (reported line 452)May include surrounding context.
AGENT ALREADY HAS: TELEGRAM_BOT_TOKEN → already in your agent .env TELEGRAM_CHAT_ID → already in your agent .env

text
### Voice Sample Requirements

Credential Access

High

Category: Privilege Escalation
Confidence: 89% confidence
Finding: The checklist directs storing ELEVENLABS_API_KEY in the agent .env as a standard setup step. Codifying this pattern increases organizational dependence on shared environment secrets and expands exposure if any skill can read env variables.
Content: Scanner excerpt · SKILL.md (reported line 481)May include surrounding context.
md
[ ] pip install twilio --break-system-packages (if using calls) [ ] apt-get update && apt-get install -y ffmpeg [ ] 3 MP3 samples uploaded to /workspace/voice/samples/ [ ] ELEVENLABS_API_KEY added to agent .env [ ] ELEVENLABS_VOICE_ID added to agent .env (after cloning) [ ] python3 voice_generator.py apply-config --api-key ... --voice-id ... [ ] voice_generator.py status shows ✅ API Key and Voice ID

Credential Access

High

Category: Privilege Escalation
Confidence: 89% confidence
Finding: The checklist also places the voice ID and subsequent apply-config flow in an agent-visible setup pattern, tying sensitive identifiers and credentials into writable local config. This increases risk of credential/config tampering or unauthorized reuse of the cloned voice configuration.
Content: Scanner excerpt · SKILL.md (reported line 482)May include surrounding context.
md
[ ] apt-get update && apt-get install -y ffmpeg [ ] 3 MP3 samples uploaded to /workspace/voice/samples/ [ ] ELEVENLABS_API_KEY added to agent .env [ ] ELEVENLABS_VOICE_ID added to agent .env (after cloning) [ ] python3 voice_generator.py apply-config --api-key ... --voice-id ... [ ] voice_generator.py status shows ✅ API Key and Voice ID [ ] Test TTS successful (output MP3 plays correctly)

Credential Access

High

Category: Privilege Escalation
Confidence: 83% confidence
Finding: The error-handling section instructs operators to check agent .env when API keys fail, further entrenching shared-environment secret handling. This operational model raises the chance that secrets will be inspected, copied, or logged during debugging.
Content: Scanner excerpt · SKILL.md (reported line 565)May include surrounding context.
text
ERROR: ELEVENLABS_API_KEY invalid or missing Action: Verify at https://elevenlabs.io/app/settings/api-keys Log: ERRORS.md → "API key invalid [date] — check agent .env" ERROR: Voice samples missing Action: Do NOT attempt voice cloning

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 24)May include surrounding context.
Then run pip install, apt-get etc. as normal

text
### Restart OpenClaw after .env changes ```bash cd /docker/openclaw-yyvg

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 46)May include surrounding context.
Then run pip install, apt-get etc. as normal

text
### Restart OpenClaw after .env changes ```bash cd /docker/openclaw-yyvg

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · setup_guide.md (reported line 23)May include surrounding context.
Then run pip install, apt-get etc. as normal

text
### Restart OpenClaw after .env changes ```bash cd /docker/openclaw-yyvg

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · setup_guide.md (reported line 140)May include surrounding context.
Then run pip install, apt-get etc. as normal

text
### Restart OpenClaw after .env changes ```bash cd /docker/openclaw-yyvg

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · setup_guide.md (reported line 232)May include surrounding context.
Then run pip install, apt-get etc. as normal

text
### Restart OpenClaw after .env changes ```bash cd /docker/openclaw-yyvg

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: The guide explicitly tells users to write an ElevenLabs API key into a .env file using shell redirection, with no warning about secret exposure, file protection, backups, shell recording, or source-control leakage. Because the key enables access to a third-party account and voice resources, compromise could allow unauthorized cloning, usage charges, or data access.
Content: Scanner excerpt · setup_guide.md (reported line 84)May include surrounding context.
bash
# Go to: https://elevenlabs.io/app/settings/api-keys # Create API Key → copy → add to .env: echo "ELEVENLABS_API_KEY=sk_your_key_here" >> /docker/openclaw-yyvg/.env # Verify curl -s https://api.elevenlabs.io/v1/user \

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.
echo "ELEVENLABS_API_KEY=sk_your_key_here" >> /docker/openclaw-yyvg/.env

Verify

curl -s https://api.elevenlabs.io/v1/user
-H "xi-api-key: $ELEVENLABS_API_KEY" | python3 -m json.tool

text

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · setup_guide.md (reported line 87)May include surrounding context.
echo "ELEVENLABS_API_KEY=sk_your_key_here" >> /docker/openclaw-yyvg/.env

Verify

curl -s https://api.elevenlabs.io/v1/user
-H "xi-api-key: $ELEVENLABS_API_KEY" | python3 -m json.tool

text

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The instructions direct users to upload local voice samples to ElevenLabs for cloning without clearly warning that personal biometric voice data is being transmitted to and processed by a third party. Because voice prints are sensitive personal data and the skill is specifically cloning a principal's identity, omission of consent, privacy, and retention warnings materially raises privacy and impersonation risk.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · setup_guide.md (reported line 118)May include surrounding context.
json.dump(config, f, indent=2)

text
### Step 3 — Clone via curl (alternative) ```bash # Clone

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · setup_guide.md (reported line 132)May include surrounding context.
md
| python3 -m json.tool # Extract and save Voice ID VOICE_ID=$(curl -s -X POST https://api.elevenlabs.io/v1/voices/add \ -H "xi-api-key: $ELEVENLABS_API_KEY" \ -F "name=[AGENT_VOICE_NAME]" \ -F "files=@/workspace/voice/samples/sample_01.mp3" \

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T05 · Unauthorized Access and Privilege Escalation

SkillSpector

Tainted flow: 'req' from os.environ.get (line 325, credential/environment) → urllib.request.urlopen (network output)

Tp4

Credential Access

Credential Access

External Script Fetching

Credential Access

Setup Twilio

External Script Fetching

Credential Access

Tool Parameter Abuse

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Then run pip install, apt-get etc. as normal

Credential Access

Then run pip install, apt-get etc. as normal

Credential Access

Then run pip install, apt-get etc. as normal

Credential Access

Then run pip install, apt-get etc. as normal

Credential Access

Then run pip install, apt-get etc. as normal

Credential Access

External Script Fetching

Verify

External Script Fetching

Verify

Missing User Warnings

External Script Fetching

External Script Fetching

Static analysis