ElevenLabs CLI

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:34 PM UTC
• Version: 0.1.7

Overview

The skill is mostly transparent and purpose-aligned, but it asks users to install and run an unpinned unofficial CLI while handling API keys, uploaded audio, voice cloning, deletion, and public sharing.

Install only if you are comfortable trusting an unofficial community CLI with your ElevenLabs API key and submitted audio/text. Prefer a pinned release or digest, use a revocable limited API key through an environment variable or secret manager, avoid config commands that may print secrets, and only clone or share voices when you have clear consent and understand visibility and deletion effects.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:43
• Finding: Unpinned installation of an unofficial third-party CLI<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:43-68` **Vulnerability Type**: Supply-chain exposure through mutable and unverified dependencies **Risk Level**: Medium ### Vulnerable Code ```bash brew tap hongkongkiwi/tap brew install elevenlabs-cli ``` ```powershell scoop bucket add elevenlabs-cli https://github.com/hongkongkiwi/scoop-elevenlabs-cli scoop install elevenlabs-cli ``` ```bash sudo snap install elevenlabs-cli ``` ```bash cargo install elevenlabs-cli ``` ```bash docker pull ghcr.io/hongkongkiwi/elevenlabs-cli:latest docker run --rm -e ELEVENLABS_API_KEY=your-key ghcr.io/hongkongkiwi/elevenlabs-cli tts "Hello!" ``` ### Technical Analysis The skill directs users to install and execute an unofficial community-maintained CLI from several third-party distribution channels. It does not pin package versions, immutable source revisions, checksums, signatures, or container image digests. The Docker instructions explicitly use the mutable `latest` tag. The Homebrew tap and Scoop bucket are hosted under a personal GitHub account, while Cargo and Snap resolve packages through external registries. Consequently, the executable installed by a user can change after this skill has been reviewed. This is a supply-chain trust issue rather than evidence that the current upstream package is malicious. Exploitation requires compromise or malicious modification of one of the referenced repositories, registry accounts, packages, or release artifacts. ### Attack Path 1. An attacker compromises an upstream maintainer account, repository, registry account, package release process, or container registry. 2. The attacker publishes a modified CLI release or replaces the image referenced by the mutable `latest` tag. 3. A user or autonomous agent follows the skill's installation instructions without verifying an immutable version or cryptographic digest. 4. The package manager downloads and installs the attacker-controlled artifact. 5. The user executes ...[truncated 985 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every installation example to a reviewed, explicit release version. 2. Replace the Docker `latest` tag with an immutable image digest, for example: ```bash docker pull ghcr.io/hongkongkiwi/elevenlabs-cli@sha256:<verified-digest> ``` 3. Publish expected SHA-256 checksums and require users to verify downloaded release artifacts before execution. 4. Document signature or provenance verification, such as Sigstore verification or registry-specific artifact attestations. 5. Where supported, pin Homebrew, Scoop, Cargo, and Snap installations to reviewed versions. 6. Prefer official ElevenLabs tooling or clearly explain the additional trust placed in the community maintainer and distribution channels. 7. Run the CLI with least privilege and isolate it from unrelated credentials and sensitive files. 8. Avoid passing API keys directly in command lines or examples; use a narrowly scoped secret injection mechanism. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:286
• Finding: API key may be persisted and exposed through configuration commands<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:90-91`, `SKILL.md:286-292` **Vulnerability Type**: Plaintext secret persistence and potential secret disclosure **Risk Level**: Medium ### Vulnerable Code The skill recommends saving the API key to a local configuration file: ```bash # Or save to config file (~/.config/elevenlabs-cli/config.toml) elevenlabs config set api_key your-key ``` It also documents commands that retrieve the key or list all configuration: ```bash # Set config value elevenlabs config set api_key your-key # Get config value elevenlabs config get api_key # List all config elevenlabs config list ``` ### Technical Analysis The instructions encourage users to persist the ElevenLabs API key in `~/.config/elevenlabs-cli/config.toml` and provide commands that request the key or enumerate all configuration values. The audited project contains documentation only and does not include the CLI implementation. It therefore cannot establish whether the credential is encrypted at rest, whether the configuration file receives restrictive permissions, or whether `config get` and `config list` redact sensitive values. If those commands return the complete key, an AI agent could place the credential in terminal output, execution logs, conversation transcripts, telemetry collected by a host application, or persistent model context. Persisting the key without enforcing restrictive file permissions could also expose it to other local users or processes. ### Attack Path 1. A user follows the documentation and runs `elevenlabs config set api_key`, causing the key to be stored in the local configuration file. 2. An agent, user, support script, or diagnostic workflow later invokes `elevenlabs config get api_key` or `elevenlabs config list`. 3. If the upstream CLI does not redact secrets, the complete credential is printed to standard output. 4. The output is captured in a terminal log, agent transcript, CI log, debugging record, or other r ...[truncated 1093 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove examples that encourage retrieving `api_key` or listing potentially sensitive configuration values. 2. Require the CLI to redact secrets in all configuration output, showing only a short non-sensitive suffix when identification is necessary. 3. Prefer ephemeral environment-variable injection or an operating-system secret manager instead of plaintext configuration storage. 4. If configuration-file storage remains supported, require restrictive owner-only permissions such as mode `0600` on Unix-like systems. 5. Document whether credentials are encrypted at rest and identify the mechanism used to protect encryption keys. 6. Warn users that command output may be retained by AI clients, terminal history, CI systems, and logging infrastructure. 7. Recommend narrowly scoped, revocable API keys and provide explicit rotation instructions. 8. Ensure diagnostic and verbose modes never print authentication headers, environment variables, or complete credential values. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

External Transmission

Medium

• Category: Data Exfiltration

Content

| Endpoint | Purpose | Data Sent |
|----------|---------|-----------|
| `https://api.elevenlabs.io/*` | ElevenLabs API | API key (auth), text/audio content, voice settings |
| `https://github.com/hongkongkiwi/elevenlabs-cli/*` | Package downloads | None (public) |

## Security & Privacy

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### Snap (Linux)

```bash
sudo snap install elevenlabs-cli
```

### Cargo (All Platforms)

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The Docker example explicitly pulls the `latest` tag, which is mutable and can change over time without notice. This weakens supply-chain integrity and reproducibility because users may run a different image than expected, including a compromised one if the registry or publishing workflow is abused.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence
• Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Voice cloning examples encourage uploading voice samples without warning about consent, impersonation risk, and the sensitivity of biometric voice data. In an audio/voice-cloning skill, this omission is materially risky because users may submit third-party samples or regulated/sensitive recordings without authorization.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The markdown includes a `voice delete` example that removes a voice, which is a destructive action affecting user data. While the file has general privacy disclosures, it does not warn users near this command that deletion may be irreversible or should be used with care.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation presents public voice sharing without clearly warning that publishing a voice may expose biometric or sensitive identity-related data and may make the asset accessible beyond the user's intended audience. In this skill context, voice data is especially sensitive, so omission of a privacy warning increases the risk of accidental overexposure.

Session Persistence

Medium

• Category: Rogue Agent

Content

Translate and dub video/audio to other languages.

```bash
# Create dubbing project
elevenlabs dub create --file video.mp4 --source-lang en --target-lang es

# Check dubbing status

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.