Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

elevenlabs-tts

v0.1.0

ElevenLabs Text-to-Speech API for high-quality speech synthesis.

0· 72·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for lnj22/pg-essay-to-audiobook-elevenlabs-tts.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "elevenlabs-tts" (lnj22/pg-essay-to-audiobook-elevenlabs-tts) from ClawHub.
Skill page: https://clawhub.ai/lnj22/pg-essay-to-audiobook-elevenlabs-tts
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install pg-essay-to-audiobook-elevenlabs-tts

ClawHub CLI

Package manager switcher

npx clawhub@latest install pg-essay-to-audiobook-elevenlabs-tts
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description and the SKILL.md align: the instructions show how to call ElevenLabs text-to-speech endpoints, include example voice IDs, and provide a working Python example. Nothing in the instructions attempts capabilities unrelated to TTS.
Instruction Scope
Instructions are narrowly scoped to calling https://api.elevenlabs.io, splitting long text, and concatenating audio with ffmpeg/pydub. They reference writing output files and using an ELEVENLABS_API_KEY environment variable. They do not instruct reading unrelated system files or exfiltrating data to unexpected endpoints.
Install Mechanism
This is an instruction-only skill with no install spec and no code files — minimal installation risk because nothing is downloaded or written by the skill itself.
!
Credentials
SKILL.md explicitly requires ELEVENLABS_API_KEY (sensitive credential) for API calls, but the registry metadata lists no required env vars or primary credential. That mismatch is concerning: the key is appropriate for a TTS skill, but the skill should declare it. Verify where/how the key will be provided and that the skill does not ask for unrelated secrets.
Persistence & Privilege
The skill does not request always:true, does not modify system or other skills, and has no install-time persistence. Default autonomous invocation is allowed but not combined with other high-risk flags.
What to consider before installing
This skill is plausibly what it says (an ElevenLabs TTS helper) but it contains a practical inconsistency: the runtime instructions expect an ELEVENLABS_API_KEY environment variable while the registry metadata does not declare any required credentials. Before installing or enabling the skill, confirm: (1) that you will provide an ELEVENLABS_API_KEY and that it is only used to call api.elevenlabs.io, (2) you are comfortable storing that key as an environment variable in the agent runtime, and (3) the skill will not request other unrelated secrets. Also note dependencies you may need at runtime (Python requests library, and ffmpeg or pydub for concatenation). If the registry metadata is corrected to declare ELEVENLABS_API_KEY as a required credential and no other unexpected privileges appear, this would likely be benign; as-is, treat it cautiously.

Like a lobster shell, security has layers — review code before you run it.

latestvk971nppr2w5ehg3e4tes83dj2584xc2e
72downloads
0stars
1versions
Updated 1w ago
v0.1.0
MIT-0

ElevenLabs Text-to-Speech

Generate high-quality speech audio from text using the ElevenLabs API.

Authentication

The API key is available as environment variable:

ELEVENLABS_API_KEY

Include in request header:

xi-api-key: $ELEVENLABS_API_KEY

API Endpoints

Text-to-Speech

POST https://api.elevenlabs.io/v1/text-to-speech/{voice_id}

Request Body:

{
  "text": "Your text here",
  "model_id": "eleven_turbo_v2_5",
  "voice_settings": {
    "stability": 0.5,
    "similarity_boost": 0.5
  }
}

Response: Audio bytes (mp3 format by default)

Popular Voice IDs

  • 21m00Tcm4TlvDq8ikWAM - Rachel (female, calm)
  • EXAVITQu4vr4xnSDxMaL - Bella (female, soft)
  • ErXwobaYiN019PkySvjV - Antoni (male, warm)
  • TxGEqnHWrfWFTfGW9XjX - Josh (male, deep)

Python Example

import os
import requests

ELEVENLABS_API_KEY = os.environ.get("ELEVENLABS_API_KEY")
VOICE_ID = "21m00Tcm4TlvDq8ikWAM"  # Rachel

def text_to_speech(text, output_path):
    url = f"https://api.elevenlabs.io/v1/text-to-speech/{VOICE_ID}"

    headers = {
        "xi-api-key": ELEVENLABS_API_KEY,
        "Content-Type": "application/json"
    }

    data = {
        "text": text,
        "model_id": "eleven_turbo_v2_5",
        "voice_settings": {
            "stability": 0.5,
            "similarity_boost": 0.75
        }
    }

    response = requests.post(url, json=data, headers=headers)

    if response.status_code == 200:
        with open(output_path, "wb") as f:
            f.write(response.content)
        return True
    else:
        print(f"Error: {response.status_code} - {response.text}")
        return False

Handling Long Text

ElevenLabs has a ~5000 character limit per request. For long documents:

  1. Split text into chunks at sentence boundaries
  2. Generate audio for each chunk
  3. Concatenate using ffmpeg or pydub:
# Create file list
echo "file 'chunk1.mp3'" > files.txt
echo "file 'chunk2.mp3'" >> files.txt

# Concatenate
ffmpeg -f concat -safe 0 -i files.txt -c copy output.mp3

Best Practices

  • Split at sentence boundaries to avoid cutting words
  • Check rate limits (varies by subscription tier)
  • Cache generated audio to avoid redundant API calls

Comments

Loading comments...