ClawHub
Back to skill

Security audit

ElevenLabs CLI

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly transparent and purpose-aligned, but it asks users to install and run an unpinned unofficial CLI while handling API keys, uploaded audio, voice cloning, deletion, and public sharing.

Install only if you are comfortable trusting an unofficial community CLI with your ElevenLabs API key and submitted audio/text. Prefer a pinned release or digest, use a revocable limited API key through an environment variable or secret manager, avoid config commands that may print secrets, and only clone or share voices when you have clear consent and understand visibility and deletion effects.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:43
Finding

Unpinned installation of an unofficial third-party CLI

Content
View full analysis
Remediation
View remediation
``` 3. Publish expected SHA-256 checksums and require users to verify downloaded release artifacts before execution. 4. Document signature or provenance verification, such as Sigstore verification or registry-specific artifact attestations. 5. Where supported, pin Homebrew, Scoop, Cargo, and Snap installations to reviewed versions. 6. Prefer official ElevenLabs tooling or clearly explain the additional trust placed in the community maintainer and distribution channels. 7. Run the CLI with least privilege and isolate it from unrelated credentials and sensitive files. 8. Avoid passing API keys directly in command lines or examples; use a narrowly scoped secret injection mechanism. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:286
Finding

API key may be persisted and exposed through configuration commands

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md
| Endpoint | Purpose | Data Sent |
|----------|---------|-----------|
| `https://api.elevenlabs.io/*` | ElevenLabs API | API key (auth), text/audio content, voice settings |
| `https://github.com/hongkongkiwi/elevenlabs-cli/*` | Package downloads | None (public) |

## Security & Privacy

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

Snap (Linux)

bash
sudo snap install elevenlabs-cli

Cargo (All Platforms)

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The Docker example explicitly pulls the latest tag, which is mutable and can change over time without notice. This weakens supply-chain integrity and reproducibility because users may run a different image than expected, including a compromised one if the registry or publishing workflow is abused.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Voice cloning examples encourage uploading voice samples without warning about consent, impersonation risk, and the sensitivity of biometric voice data. In an audio/voice-cloning skill, this omission is materially risky because users may submit third-party samples or regulated/sensitive recordings without authorization.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The markdown includes a voice delete example that removes a voice, which is a destructive action affecting user data. While the file has general privacy disclosures, it does not warn users near this command that deletion may be irreversible or should be used with care.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The documentation presents public voice sharing without clearly warning that publishing a voice may expose biometric or sensitive identity-related data and may make the asset accessible beyond the user's intended audience. In this skill context, voice data is especially sensitive, so omission of a privacy warning increases the risk of accidental overexposure.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 219)May include surrounding context.

Translate and dub video/audio to other languages.

bash
# Create dubbing project
elevenlabs dub create --file video.mp4 --source-lang en --target-lang es

# Check dubbing status