Security audit

Voice Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned for voice generation, but it gives the agent broad account, voice-cloning, credential, and calling authority with weak scoping and plaintext persistence.

Review carefully before installing. Use only dedicated ElevenLabs/Twilio accounts, scoped tokens, and a dedicated browser profile; avoid putting account passwords or broad auth tokens in .env; require explicit consent for voice cloning and comply with call-recording, telemarketing, and outreach laws before enabling calls.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:263
Finding: Unpinned Dependencies Installed into the System Python Environment
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:143
Finding: ElevenLabs API Credentials Are Persisted Redundantly in Plaintext Files
Content: View full analysis
> /docker/openclaw-yyvg/.env echo "✅ ELEVENLABS_VOICE_ID written to .env" ``` The Python implementation reads and writes the plaintext configuration without applying restrictive permissions: ```python def load_config(): if not os.path.exists(CONFIG_FILE): return {} with open(CONFIG_FILE, encoding="utf-8") as f: return json.load(f) def save_config(data): os.makedirs(os.path.dirname(CONFIG_FILE), exist_ok=True) with open(CONFIG_FILE, "w", encoding="utf-8") as f: json.dump(data, f, indent=2) def get_api_key(): cfg = load_config() key = cfg.get("ELEVENLABS_API_KEY") or os.environ.get("ELEVENLABS_API_KEY") if not key: print("❌ ELEVENLABS_API_KEY not found in config.json or .env") print(" Run voice-agent setup first, or set the key manually.") sys.exit(1) return key ``` ### Technical Analysis The API key is deliberately persisted in both `config.json` and an environment file. This duplication exceeds the minimum ...[truncated 1629 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: voice_generator.py:141
Finding: Predictable Shared Temporary Files Permit Symlink and Concurrency Attacks
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:103
Finding: Autonomous Setup Reuses an Authenticated Google Browser Session and Creates Credentials
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (43)

Credential Access

High

Category: Privilege Escalation
Confidence: 84% confidence
Finding: The README instructs users to place sensitive credentials in a .env file for automated use, while the broader skill is designed to self-configure external services and make calls. Although using .env is common, in this context it increases the risk of credential exposure, overbroad reuse by the agent, or accidental leakage through logs, workspace access, or downstream automation.
Content: Scanner excerpt · README.md (reported line 41)May include surrounding context.
text
Minimum (TTS only): → Google connected in virtual-desktop, OR email/password in .env → 3 MP3 voice samples in /workspace/voice/samples/ For calls (add):

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The code's real primary function is narrower than the description: it generates TTS audio using an existing ElevenLabs API key and voice ID, reports status, and summarizes/list call-related JSON records. There is no code for cloning voices, creating/managing an ElevenLabs conversational agent, integrating with Twilio APIs, placing or answering calls, or navigating a website/virtual desktop to self-configure credentials. The call-related functionality is limited to reading pending/history files from disk, not executing telephony actions. Thus the description materially overstates the implemented capabilities and setup behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill promotes voice cloning, automated calling, transcript collection, and reporting without a prominent upfront warning about consent, legal compliance, and biometric/privacy sensitivity. In this context, missing warnings materially increase the chance of unsafe or unauthorized impersonation and recording workflows.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 98% confidence
Finding: The skill explicitly automates credential retrieval and writes all credentials to .env automatically. That encourages collection, persistence, and reuse of secrets in a broadly accessible format, which is dangerous in any agent environment.
Content: Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.
md
Navigates elevenlabs.io autonomously via virtual-desktop Logs in via Google OAuth or email/password Creates API key, clones voice, configures agent Writes all credentials to .env automatically LAYER 2 — TEXT TO SPEECH Converts any text to MP3 using Wesley's cloned voice

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The skill instructs reading ElevenLabs email/password from .env for automated login. Using stored account passwords for browser automation increases blast radius if the environment or logs are exposed.
Content: Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.
md
5. Proceed to API key creation OPTION B — Email / Password Condition: ELEVENLABS_EMAIL and ELEVENLABS_PASSWORD in .env Process: 1. virtual-desktop opens https://elevenlabs.io/app/sign-in

Credential Access

High

Category: Privilege Escalation
Confidence: 89% confidence
Finding: The skill depends on reading Twilio credentials from .env to configure telephony features. These credentials can enable call placement, messaging, and account changes, so storing and consuming them this way creates substantial account-compromise risk.
Content: Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.
Step 5 — Create Conversational Agent (optional — for calls)

text
Only runs if TWILIO_ACCOUNT_SID is in .env Navigation path: Dashboard → "Agents" → "Create Agent"

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 270)May include surrounding context.
Step 2 — Verify API key works

bash
curl -s https://api.elevenlabs.io/v1/user -H "xi-api-key: $ELEVENLABS_API_KEY" | python3 -m json.tool # Expected: JSON with subscription info # If 401 error: API key is wrong or expired

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 309)May include surrounding context.
print(f"✅ Voice ID saved to config.json")

text
#### Step 3 — Clone via curl (alternative) ```bash # Clone with multiple files

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 319)May include surrounding context.
md
# { "voice_id": "abc123...", "name": "Wesley" } # Extract and save the voice_id VOICE_ID=$(curl -s -X POST https://api.elevenlabs.io/v1/voices/add -H "xi-api-key: $ELEVENLABS_API_KEY" -F "name=Wesley" -F "files=@/workspace/voice/samples/sample_01.mp3" -F "files=@/workspace/voice/samples/sample_02.mp3" -F "files=@/workspace/voice/samples/sample_03.mp3" | python3 -c "import sys,json; print(json.load(sys.stdin)['voice_id'])") echo "Voice ID: $VOICE_ID"

Credential Access

High

Category: Privilege Escalation
Confidence: 99% confidence
Finding: This instruction appends data into a global .env file, normalizing direct secret/state persistence outside the skill boundary. Such patterns commonly lead to secret leakage, accidental reuse, and privilege spread across tasks.
Content: Scanner excerpt · SKILL.md (reported line 323)May include surrounding context.
echo "Voice ID: $VOICE_ID"

Write to .env

echo "ELEVENLABS_VOICE_ID=$VOICE_ID" >> /docker/openclaw-yyvg/.env echo "✅ ELEVENLABS_VOICE_ID written to .env"

text

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill directs writing sensitive identifiers into a global .env file outside the declared workspace, which bypasses the skill's stated boundary and persists secrets in a broader shared location. This can expose credentials to unrelated processes, users, or later tasks.
Content: No source excerpt is available for this finding.

Scope Creep

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Appending ELEVENLABS_VOICE_ID to /docker/openclaw-yyvg/.env violates the declared permission model and normalizes writing agent-derived state into a global environment file. While a voice ID is less sensitive than an API key, the out-of-scope write still breaks containment and can facilitate later misuse.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 99% confidence
Finding: Even though the specific value here is a voice ID, the pattern is still credential/state persistence in a global environment file. It creates an unsafe precedent and broadens access to data generated by the skill.
Content: Scanner excerpt · SKILL.md (reported line 324)May include surrounding context.
echo "Voice ID: $VOICE_ID"

Write to .env

echo "ELEVENLABS_VOICE_ID=$VOICE_ID" >> /docker/openclaw-yyvg/.env echo "✅ ELEVENLABS_VOICE_ID written to .env"

text

Credential Access

High

Category: Privilege Escalation
Confidence: 99% confidence
Finding: The repeated instruction confirming write to .env reinforces unsafe secret-handling behavior and indicates persistence of operational data in a shared global location. This compounds risk of later disclosure or misuse.
Content: Scanner excerpt · SKILL.md (reported line 325)May include surrounding context.
Write to .env

echo "ELEVENLABS_VOICE_ID=$VOICE_ID" >> /docker/openclaw-yyvg/.env echo "✅ ELEVENLABS_VOICE_ID written to .env"

text
#### Step 4 — List all voices (verify clone appears)

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 331)May include surrounding context.
Step 4 — List all voices (verify clone appears)

bash
# Via curl curl -s https://api.elevenlabs.io/v1/voices -H "xi-api-key: $ELEVENLABS_API_KEY" | python3 -c " import sys, json data = json.load(sys.stdin)

Credential Access

High

Category: Privilege Escalation
Confidence: 97% confidence
Finding: The documented step to 'Get API Key from dashboard' instructs the agent to retrieve a credential directly from a provider UI. This is credential harvesting behavior, and in the context of autonomous browser control it is particularly dangerous because it bypasses normal user-mediated secret handling.
Content: Scanner excerpt · SKILL.md (reported line 406)May include surrounding context.
→ If login fails: log to ERRORS.md, notify principal

text
#### Step 2 — Get API Key from dashboard

Navigation path (2026 UI):

Credential Access

High

Category: Privilege Escalation
Confidence: 99% confidence
Finding: This step instructs capturing a newly created API key from the dashboard and writing it to /docker/openclaw-yyvg/.env. Harvesting and persisting one-time-visible secrets into a global file is a serious credential-handling weakness.
Content: Scanner excerpt · SKILL.md (reported line 421)May include surrounding context.
→ Or: find input with type="password" that appears after creation 8. Save immediately: → Write to /workspace/voice/config.json → Write to /docker/openclaw-yyvg/.env as ELEVENLABS_API_KEY=sk_...

Direct URL shortcut: https://elevenlabs.io/app/settings/api-keys

text

Scope Creep

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Documented behavior writes ELEVENLABS_API_KEY to /docker/openclaw-yyvg/.env, which is outside declared write permissions. That is a boundary violation and creates secret persistence in a sensitive global location.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 86% confidence
Finding: Saving identifiers to both config.json and .env broadens storage locations unnecessarily. Duplicating operational state across files increases exposure and complicates revocation and auditing.
Content: Scanner excerpt · SKILL.md (reported line 446)May include surrounding context.
→ Click the three-dot menu "⋯" on the voice card → Click "Copy Voice ID" → Or find in URL: elevenlabs.io/app/voice-lab/[VOICE_ID] 12. Save to config.json + .env

Direct URL shortcut: https://elevenlabs.io/app/voice-lab

text

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: The skill documents a direct DELETE operation on externally hosted voice resources with a variable identifier and no confirmation or ownership checks. In an agent setting, destructive API actions without validation can delete the wrong asset or be abused through parameter manipulation.
Content: Scanner excerpt · SKILL.md (reported line 478)May include surrounding context.
md
→ Background noise in samples → Multiple speakers in same file Solution: → Delete the bad clone: DELETE /v1/voices/{voice_id} curl -X DELETE https://api.elevenlabs.io/v1/voices/$VOICE_ID -H "xi-api-key: $ELEVENLABS_API_KEY" → Record new samples (quieter environment, longer duration) → Re-run cloning process

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 479)May include surrounding context.
md
→ Multiple speakers in same file Solution: → Delete the bad clone: DELETE /v1/voices/{voice_id} curl -X DELETE https://api.elevenlabs.io/v1/voices/$VOICE_ID -H "xi-api-key: $ELEVENLABS_API_KEY" → Record new samples (quieter environment, longer duration) → Re-run cloning process

Credential Access

High

Category: Privilege Escalation
Confidence: 92% confidence
Finding: Telling the operator to update config.json and .env with regenerated API keys extends the same insecure credential lifecycle pattern. Reissued keys remain vulnerable if stored in plaintext local files.
Content: Scanner excerpt · SKILL.md (reported line 490)May include surrounding context.
md
PROBLEM: "Invalid API key" (401) Solution: Regenerate key in dashboard Direct URL: https://elevenlabs.io/app/settings/api-keys Update config.json and .env with new key PROBLEM: ffmpeg not found for audio concatenation Solution:

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 507)May include surrounding context.
md
GET /v1/voices → list all voices POST /v1/voices/add → create IVC clone (multipart form) GET /v1/voices/{id} → get voice details DELETE /v1/voices/{id} → delete a voice POST /v1/text-to-speech/{id} → generate audio (JSON body) GET /v1/models → list available models

Credential Access

High

Category: Privilege Escalation
Confidence: 83% confidence
Finding: The setup guidance normalizes storing ElevenLabs email/password in .env as a standard option. That encourages weak secret hygiene for primary account credentials instead of safer delegated access methods.
Content: Scanner excerpt · SKILL.md (reported line 654)May include surrounding context.
text
MINIMUM (TTS only — no calls): Option A: Google account connected in virtual-desktop browser Option B: ELEVENLABS_EMAIL + ELEVENLABS_PASSWORD in .env + 3 MP3 voice samples in /workspace/voice/samples/ FOR CALLS (add Twilio):

Credential Access

High

Category: Privilege Escalation
Confidence: 83% confidence
Finding: The instruction to add Twilio credentials to .env for calls encourages storing highly sensitive telephony credentials in plaintext configuration. If exposed, attackers could place calls/messages, access logs, or reconfigure account assets.
Content: Scanner excerpt · SKILL.md (reported line 682)May include surrounding context.
md
→ Save as MP3 (any quality works for IVC) → Upload to /workspace/voice/samples/ 3. (Optional) Add Twilio credentials to .env for calls 4. Run voice-agent — it configures itself automatically

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: SKILL.md:185

Overview

A.I.G

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T05 · Unauthorized Access and Privilege Escalation

SkillSpector

Credential Access

Tp4

Missing User Warnings

Credential Access

Credential Access

Credential Access

Step 5 — Create Conversational Agent (optional — for calls)

External Script Fetching

Step 2 — Verify API key works

External Script Fetching

External Script Fetching

Credential Access

Write to .env

Context-Inappropriate Capability

Scope Creep

Credential Access

Write to .env

Credential Access

Write to .env

External Script Fetching

Step 4 — List all voices (verify clone appears)

Credential Access

Credential Access

Scope Creep

Credential Access

Tool Parameter Abuse

External Script Fetching

Credential Access

Tool Parameter Abuse

Credential Access

Credential Access

Static analysis

Prompt-injection style instruction pattern detected.