Axiomata Voice

PassAudited by ClawScan on May 13, 2026.

Overview

This voice skill shows no malicious behavior, but it asks for ElevenLabs/Telegram credentials and the reviewed package appears incomplete for real audio generation and Telegram delivery.

This skill appears safe to inspect, but it is incomplete. Before installing or using it, confirm that the missing Telegram sending code exists and is reviewed, and only provide ElevenLabs or Telegram credentials when you are ready for text to be sent to those services.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

If configured, the agent may be able to use your ElevenLabs account and Telegram bot for the requested voice workflow.

Why it was flagged

These are sensitive service credentials. Their use is purpose-aligned for TTS generation and Telegram delivery, but users should recognize the account authority they grant.

Skill content

**Requires:**
- ElevenLabs API key
- Telegram bot token

Recommendation

Use revocable, least-privilege tokens; only set them when needed; and confirm destination chat IDs and message contents before sending.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Telegram delivery may fail or require additional code that was not reviewed here.

Why it was flagged

The manifest and provided file contents include only scripts/voice_tts.py, so the documented Telegram helper is absent from the reviewed package.

Skill content

python3 scripts/voice_send.py --text "Hello" --chat_id <chat_id>
...
voice_send.py     # Telegram delivery

Recommendation

Do not provide or use a Telegram bot token for this skill until the missing Telegram delivery script is included and reviewed.

Low

#ASI09: Human-Agent Trust Exploitation

What this means

An agent or user might believe audio was generated when the reviewed script only prints status messages.

Why it was flagged

The included TTS script checks for an API key and returns success, but it does not actually call ElevenLabs or write the requested audio output.

Skill content

print("[TTS] Note: Requires valid ElevenLabs API key to execute")
    
    return 0

Recommendation

Verify that an output audio file is actually created before relying on the skill for voice generation.