Elevenlabs

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:09 AM UTC
• Version: 1.3.4

Overview

This ElevenLabs skill performs disclosed audio, voice, and quota operations against the ElevenLabs API, with sensitive voice-cloning behavior that users should handle carefully.

Install only if you are comfortable sending text prompts, generation settings, account usage requests, and any selected voice samples to ElevenLabs. Use voice cloning only with recordings you own or have permission to use, protect the API key, prefer a virtual environment with pinned dependencies, and avoid storing the key in synced dotfiles or committed .env files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SETUP.md:14

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Remediation

View remediation

--hash=sha256: ``` 3. Instruct users to install dependencies with hash enforcement: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Recommend installation inside a dedicated virtual environment rather than the user's global Python environment. 5. Use automated dependency vulnerability scanning and review dependency updates before changing the lock file. 6. Document the intended Python and dependency versions in `SKILL.md` and `SETUP.md`. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: .

Finding

HTTP Requests Can Block Indefinitely Due to Missing Timeouts

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (40)

Tainted flow: 'headers' from os.environ.get (line 107, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/dialogs.py (reported line 128)May include surrounding context.

python

data["seed"] = seed
    
    # Make request
    response = requests.post(url, headers=headers, json=data, timeout=300)
    
    if response.status_code != 200:
        detail = response.text

Tainted flow: 'headers' from os.environ.get (line 130, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/quota.py (reported line 92)May include surrounding context.

python

url = "https://api.elevenlabs.io/v1/user/subscription"
    headers = {"xi-api-key": api_key}
    
    response = requests.get(url, headers=headers)
    if response.status_code != 200:
        raise RuntimeError(f"API error {response.status_code}: {response.text}")

Tainted flow: 'headers' from os.environ.get (line 130, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/quota.py (reported line 138)May include surrounding context.

python

"aggregation_interval": aggregation_interval,
    }
    
    response = requests.get(url, headers=headers, params=params)
    if response.status_code != 200:
        raise RuntimeError(f"API error {response.status_code}: {response.text}")

Tainted flow: 'api_key' from os.environ.get (line 41, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/sfx.py (reported line 70)May include surrounding context.

python

print(f"   Looping: enabled")
    print(f"   Influence: {prompt_influence}")
    
    response = requests.post(
        API_URL,
        headers={
            "xi-api-key": api_key,

Tainted flow: 'headers' from os.environ.get (line 67, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/speech.py (reported line 85)May include surrounding context.

python

}
    }
    
    response = requests.post(url, headers=headers, json=data)
    
    if response.status_code != 200:
        detail = response.text

Tainted flow: 'headers' from os.environ.get (line 76, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/voiceclone.py (reported line 158)May include surrounding context.

python

mime_type = mime_types.get(suffix, "audio/mpeg")
            files_list.append(("files", (path.name, file_handles[i], mime_type)))
        
        response = requests.post(url, headers=headers, files=files_list)
        
    finally:
        for fh in file_handles:

Tainted flow: 'api_key' from os.environ.get (line 23, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/voices.py (reported line 29)May include surrounding context.

python

sys.exit(1)

    try:
        response = requests.get(API_URL, headers={"xi-api-key": api_key}, timeout=30)
        response.raise_for_status()
        data = response.json()

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The voice-cloning capability is materially more sensitive than ordinary TTS and is not highlighted in the top-level skill description, while some declared features may not be implemented. Understating voice cloning is risky because users may not appreciate that local audio samples can be uploaded to a third-party service to create a reusable synthetic voice.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The voice-cloning capability is materially more sensitive than ordinary TTS and is not highlighted in the top-level skill description, while some declared features may not be implemented. Understating voice cloning is risky because users may not appreciate that local audio samples can be uploaded to a third-party service to create a reusable synthetic voice.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The voice-cloning capability is materially more sensitive than ordinary TTS and is not highlighted in the top-level skill description, while some declared features may not be implemented. Understating voice cloning is risky because users may not appreciate that local audio samples can be uploaded to a third-party service to create a reusable synthetic voice.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The voice-cloning capability is materially more sensitive than ordinary TTS and is not highlighted in the top-level skill description, while some declared features may not be implemented. Understating voice cloning is risky because users may not appreciate that local audio samples can be uploaded to a third-party service to create a reusable synthetic voice.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The voice-cloning capability is materially more sensitive than ordinary TTS and is not highlighted in the top-level skill description, while some declared features may not be implemented. Understating voice cloning is risky because users may not appreciate that local audio samples can be uploaded to a third-party service to create a reusable synthetic voice.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The voice-cloning capability is materially more sensitive than ordinary TTS and is not highlighted in the top-level skill description, while some declared features may not be implemented. Understating voice cloning is risky because users may not appreciate that local audio samples can be uploaded to a third-party service to create a reusable synthetic voice.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Voice cloning is a high-risk feature because uploaded samples may contain biometric voice data and can be used to impersonate individuals. Omitting a privacy and consent warning materially increases the risk of non-consensual cloning, policy violations, and exposure of sensitive personal data to a third-party provider.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The setup instructs users to persist the ElevenLabs API key in a shell profile or optional .env files, which stores a reusable secret in plaintext on disk. If the workstation is compromised, backups are exposed, dotfiles are synced, or the state directory is read by other local processes, the API key can be stolen and abused for API consumption, billing impact, or access to associated account resources.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SETUP.md (reported line 62)May include surrounding context.

Copy your voice samples there before running voice clone commands:

bash

mkdir -p ~/.openclaw/elevenlabs/voiceclone-samples
cp ~/path/to/sample.mp3 ~/.openclaw/elevenlabs/voiceclone-samples/

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises capabilities that imply environment access, filesystem reads/writes, network access, and shell execution, but it does not declare any explicit tool scope such as permissions or allowed-tools. That increases the chance the agent runs with broader privileges than users or the platform expect, especially for a skill that can upload data to a third-party API and manipulate local files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description does not warn users that prompts, generated content requests, voice samples, and potentially account usage data are sent to ElevenLabs over the network. Without that disclosure, users may provide sensitive text or audio under the false assumption processing is local.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

text

### 5. Voice Cloning (`voiceclone.py`)
Create instant voice clones from audio samples.

**Security:** by default this script will only read files from:
- `~/.openclaw/elevenlabs/voiceclone-samples/`

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module docstring states it generates dialogue "with timestamps" and the module usage example advertises result.voice_segments and result.alignment, but generate_dialogue explicitly notes the endpoint returns raw audio bytes only and always returns empty voice_segments with alignment and normalized_alignment set to None (L142-L150). This is an active contradiction between the documentation and actual behavior, not merely an omission.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/dialogs.py (reported line 128)May include surrounding context.

python

data["seed"] = seed
    
    # Make request
    response = requests.post(url, headers=headers, json=data, timeout=300)
    
    if response.status_code != 200:
        detail = response.text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The function transmits user-provided dialogue text, voice selections, and related generation settings to a third-party API, but the execution path provides no explicit runtime warning or consent checkpoint. In agent environments, users may not realize sensitive prompts or PII are leaving the local boundary, which creates a privacy and data-governance risk.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/dialogs.py (reported line 185)May include surrounding context.

python

str(clip_path),
        ]
        
        result = subprocess.run(cmd, capture_output=True, text=True)
        if result.returncode != 0:
            print(f"Warning: ffmpeg failed for segment {i}: {result.stderr}", file=sys.stderr)
            continue

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/music.py (reported line 72)May include surrounding context.

python

else:
        raise ValueError("Either prompt or composition_plan_json must be provided")

    response = requests.post(url, headers=headers, params=params, json=payload, timeout=120)

    if response.status_code >= 400:
        detail = response.text.strip()

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/sfx.py (reported line 70)May include surrounding context.

python

print(f"   Looping: enabled")
    print(f"   Influence: {prompt_influence}")
    
    response = requests.post(
        API_URL,
        headers={
            "xi-api-key": api_key,

Static analysis

No suspicious patterns detected.