ElevenLabs

AdvisoryAudited by Static analysis on May 6, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Installing the plugin adds external ClawLink tooling to OpenClaw, and that plugin will handle the actual ElevenLabs operations.

Why it was flagged

The skill depends on a separately installed plugin that is not part of the reviewed artifact. The install is user-directed and purpose-aligned, but users should verify the plugin source.

Skill content
Install the verified ClawLink plugin: `openclaw plugins install clawhub:clawlink-plugin`
Recommendation

Install only the intended ClawLink plugin from a trusted source and review ClawLink verification/docs before pairing.

What this means

After pairing, OpenClaw through ClawLink can access connected ElevenLabs capabilities according to the user's approved permissions.

Why it was flagged

This shows delegated account access and a locally stored credential. The destination and purpose are disclosed, making it proportionate to the integration.

Skill content
The resulting device credential is stored locally in OpenClaw's plugin config and is only sent to `claw-link.dev`.
Recommendation

Pair only on trusted devices, verify the claw-link.dev domain, and revoke the ClawLink or ElevenLabs connection if you no longer want this access.

What this means

Approved actions could create or change ElevenLabs voices, audio projects, or related assets.

Why it was flagged

The skill can perform write actions through ClawLink, but it explicitly requires preview and user confirmation before those actions.

Skill content
For writes or anything marked as requiring confirmation, call `clawlink_preview_tool` first, then confirm with the user. Execute with `clawlink_call_tool`.
Recommendation

Review previews carefully before confirming write, destructive, external-facing, or bulk operations.

What this means

Your ElevenLabs connection flow and related tool requests may pass through ClawLink rather than direct local API configuration.

Why it was flagged

ElevenLabs connection and tool operations are mediated by a third-party integration hub. This is disclosed and purpose-aligned, but it means data and credential flows depend on ClawLink.

Skill content
Powered by [ClawLink](https://claw-link.dev), an integration hub for OpenClaw that handles hosted connection flows and credentials
Recommendation

Review ClawLink's documentation, privacy/security posture, and connected ElevenLabs scopes before authorizing the integration.