Elevenlabs Pro

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a straightforward ElevenLabs text-to-speech helper, with the main caveat that it uses an ElevenLabs API key and sends requested text to ElevenLabs, which may consume account credits.

This skill looks coherent for ElevenLabs text-to-speech. Before installing, be comfortable providing an ElevenLabs API key, sending the text you ask it to speak to ElevenLabs, and allowing it to write the requested audio file locally.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

If installed and used, the agent may use the provided ElevenLabs key to generate speech and check subscription information, potentially spending account credits.

Why it was flagged

The skill needs an ElevenLabs API key, which grants access to the user's ElevenLabs account and can be used to consume credits. This is purpose-aligned and disclosed, though the registry metadata does not declare a primary credential.

Skill content

Set your API key as an environment variable:
```bash
export ELEVENLABS_API_KEY=sk_...
```

Or pass it directly with `--api-key`.

Recommendation

Use a dedicated or revocable ElevenLabs API key, monitor account usage, and avoid pasting long-lived secrets into command history when possible.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

Generated audio requests may transmit sensitive text to ElevenLabs and create or overwrite local MP3 files at the selected path.

Why it was flagged

The script posts the requested text to the ElevenLabs API and writes the returned audio to a caller-specified path. This matches the skill's purpose, but users should notice that text leaves the local machine and the output path can create or overwrite files chosen by the invocation.

Skill content

r = requests.post(url, headers=headers, json=payload, stream=True)
...
output = Path(output_path)
output.parent.mkdir(parents=True, exist_ok=True)
with open(output, "wb") as f:

Recommendation

Only send text appropriate for ElevenLabs processing, review output paths before use, and confirm large or costly generations before running them.