Miranda SAG (ElevenLabs TTS say-UX)

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:44 PM UTC
• Version: 1.0.0

Overview

This skill is a small, coherent ElevenLabs text-to-speech helper, with ordinary but real privacy and supply-chain cautions.

Before installing, confirm that you trust the sag Homebrew tap and ElevenLabs account use. Do not pass secrets, personal data, or regulated content to the voice command unless that is acceptable for your ElevenLabs usage, and delete generated MP3 files when they contain sensitive speech.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Executable Installed from a Third-Party Homebrew Tap

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Complete Code Snippet:

yaml

metadata: {"clawdbot":{"emoji":"🗣️","requires":{"bins":["sag"],"env":["ELEVENLABS_API_KEY"]},"primaryEnv":"ELEVENLABS_API_KEY","install":[{"id":"brew","kind":"brew","formula":"steipete/tap/sag","bins":["sag"],"label":"Install sag (brew)"}]}}

Technical Analysis

The skill instructs the environment to install the sag executable from the third-party Homebrew tap steipete/tap. The dependency declaration does not pin an immutable version or source revision and does not specify a checksum or another integrity-verification mechanism.

Consequently, the code installed in the future may differ from the code that existed when this skill was audited. This creates a supply-chain trust boundary: compromise of the tap, formula, referenced release artifact, maintainer account, or distribution infrastructure could cause an altered executable to be installed.

This risk is security-relevant because the installed executable is expected to receive the ELEVENLABS_API_KEY environment variable and user-provided text. The audit found no evidence that the currently referenced package is malicious; the finding concerns the dependency acquisition and verification mechanism.

Attack Path

1. An attacker compromises the third-party tap, its maintainer account, the formula's upstream artifact, or associated distribution infrastructure.
2. The attacker publishes a modified sag formula or executable under the same trusted package name.
3. A user installs or upgrades the dependency through the skill's unpinned Homebrew installation configuration.
4. The modified executable runs with the invoking user's privileges when the skill calls sag.
5. The executable can read data available to its process, including the ElevenLabs API key and text submitted for speech gen ...[truncated 767 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer a verified official distribution channel controlled by the software publisher.
2. Pin the dependency to an immutable release version or source revision rather than tracking a mutable formula.
3. Verify downloaded artifacts with a publisher-provided SHA-256 checksum and, where available, a cryptographic signature.
4. Record the expected upstream repository and artifact source so maintainers can verify package provenance.
5. Review Homebrew formula changes and release checksums before upgrades; avoid unattended upgrades for this dependency.
6. Run the executable with the minimum required environment and filesystem access. Pass only the required API credential and avoid exposing unrelated secrets.
7. Where practical, isolate execution in a sandbox with restricted filesystem and network permissions.
8. Document a dependency-review and update process so each new version is assessed before changing the pin.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation requires an ElevenLabs API key and promotes sending arbitrary text to a cloud TTS service, but it does not clearly disclose that prompts and response content will be transmitted to a third party. This creates a realistic privacy and data-handling risk if users or downstream agents speak sensitive material, because they may assume the tool is purely local aside from playback.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The example instructs writing audio output to /tmp/voice-reply.mp3 without warning that this creates a local artifact containing potentially sensitive spoken content. On multi-user or shared environments, temporary files may be exposed, overwritten, or linger longer than expected, increasing the chance of inadvertent disclosure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.