ClawHub
Back to skill

Security audit

Axiomata Voice

Security checks for vulnerabilities and agentic risk

Overview

The skill asks users to set up voice and messaging services, but the packaged code is mostly a stub and some advertised files are missing.

Review before installing. The main risk is not hidden malware; it is that the skill is under-implemented while asking users to prepare API credentials and external messaging services. Do not provide sensitive text to ElevenLabs or Telegram through this skill without understanding that those services would receive the content if the missing functionality is later added.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The declared description promises a functional TTS and Telegram voice-delivery skill using ElevenLabs and ffmpeg. The supplied code only provides a command-line interface and environment-variable check, then logs informational messages and exits successfully. Its actual behavior is therefore materially narrower than the declared purpose: the core advertised capabilities—speech synthesis, audio processing, and Telegram delivery—are not implemented in this code chunk.

Lp3

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding
The skill documents use of environment variables and external services but does not declare an explicit tool scope or permissions boundary. In an agent ecosystem, this can cause the skill to receive broader access than users expect, increasing the risk of secret access or unintended external actions.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill instructs users to send text to ElevenLabs and Telegram but does not prominently warn that message contents will be transmitted to third-party services. This can lead to unintentional disclosure of sensitive, personal, or regulated data through external APIs and messaging platforms.

External Transmission

Medium
Category
Data Exfiltration
Content
### API Call Example

```bash
curl -X POST "https://api.elevenlabs.io/v1/text-to-speech/<voice_id>" \
  -H "xi-api-key: $ELEVENLABS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"text": "Hello world", "voice_settings": {"stability": 0.5}}'
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
### API Call Example

```bash
curl -X POST "https://api.elevenlabs.io/v1/text-to-speech/<voice_id>" \
  -H "xi-api-key: $ELEVENLABS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"text": "Hello world", "voice_settings": {"stability": 0.5}}'
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The module docstring says 'Text-to-Speech generation using ElevenLabs API' and the function docstring says 'Convert text to speech.' However, the implementation only prints metadata and returns, creating a direct contradiction between the documented intent and the real behavior.

Description-Behavior Mismatch

Medium
Confidence
98% confidence
Finding
The manifest describes a Text-to-Speech skill that uses ElevenLabs for synthesis and provides audio generation and Telegram delivery. In this file, the core function only reads an environment variable and prints status messages before returning success, so its actual behavior does not match the claimed TTS functionality.

Static analysis

No suspicious patterns detected.