ClawHub
Back to skill

Security audit

Elevenlabs Tts

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: sends job text to ElevenLabs to generate voiceover audio and subtitle timings, then updates files in the job folder.

Install only if you are comfortable sending the job's TTS script and voice settings to ElevenLabs using your API key. Do not place secrets, regulated content, or private text in input.json unless that disclosure is acceptable, and keep backups if preserving original predicted subtitles matters.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

md
## Provider details

- Endpoint: `https://api.elevenlabs.io/v1/text-to-speech/<voice_id>/with-timestamps`
- Auth header: `xi-api-key: $ELEVENLABS_API_KEY`
- Model: `eleven_multilingual_v2`
- Response: JSON with `audio_base64` and `alignment` (character-level timings)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.

md
## Provider details

- Endpoint: `https://api.elevenlabs.io/v1/text-to-speech/<voice_id>/with-timestamps`
- Auth header: `xi-api-key: $ELEVENLABS_API_KEY`
- Model: `eleven_multilingual_v2`
- Response: JSON with `audio_base64` and `alignment` (character-level timings)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.

md
## Provider details

- Endpoint: `https://api.elevenlabs.io/v1/text-to-speech/<voice_id>/with-timestamps`
- Auth header: `xi-api-key: $ELEVENLABS_API_KEY`
- Model: `eleven_multilingual_v2`
- Response: JSON with `audio_base64` and `alignment` (character-level timings)

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The skill sends tts.script and voice parameters from the job input to ElevenLabs over the network. This is a real external data transmission because potentially sensitive user-provided content is exfiltrated to a third-party service, even if that behavior is part of the skill's stated purpose. The context makes it expected, but not harmless: any secrets or regulated content placed in input.json would leave the local trust boundary.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

bash
   RESP_FILE=$(mktemp)
   HTTP_CODE=$(curl -sS -X POST \
     "https://api.elevenlabs.io/v1/text-to-speech/$VOICE_ID/with-timestamps" \
     -H "xi-api-key: $ELEVENLABS_API_KEY" \
     -H "Content-Type: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The retry path performs the same outbound transmission of tts.script and related data to ElevenLabs a second time. This duplicates the exfiltration surface and can increase privacy exposure, especially when failures are caused by transient upstream issues rather than local validation problems. In this skill's context the retry is operationally reasonable, but it still extends third-party disclosure.

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

md
echo "First attempt failed (HTTP $HTTP_CODE): $ERR_MSG. Retrying..." >&2
     sleep 2
     # retry once with same call
     HTTP_CODE=$(curl -sS -X POST \
       "https://api.elevenlabs.io/v1/text-to-speech/$VOICE_ID/with-timestamps" \
       -H "xi-api-key: $ELEVENLABS_API_KEY" \
       -H "Content-Type: application/json" \

Static analysis

No suspicious patterns detected.