ElevenLabs Voices

• Outcome: Review
• Latest audit: Jul 10, 2026 · 2:47 AM UTC
• Version: 2.1.6

Overview

This appears to be a real ElevenLabs voice tool, but it needs review because its credential storage, output-file handling, and local prompt logging are under-scoped or inconsistently documented.

Review before installing. Use an environment variable for the ElevenLabs API key rather than setup-created config.json or a skill-local .env file, avoid processing untrusted batch JSON, keep output paths inside a dedicated directory, and do not submit sensitive text or prompts unless you are comfortable sending them to ElevenLabs and possibly retaining limited local usage records.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documentation describes capabilities to read environment variables, read and write local files, and make network requests, but it does not declare permissions accordingly. This weakens user and platform visibility into what the skill can access, increasing the chance that sensitive operations like API key handling, config writes, or remote requests occur without informed consent. In this context those capabilities are expected for a TTS skill, but the undeclared access is still a security transparency issue.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The documented trigger phrases are generic, such as 'list voices' and 'design a voice', and lack qualifiers tying them to this specific skill or requiring explicit user confirmation. In an agent environment, broad triggers can cause unintended invocation, leading to accidental API usage, unwanted network calls, or audio generation actions based on ambiguous user language.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The documentation recommends placing the API key in a local `.env` file without warning that this is plaintext secret storage. If file permissions are weak, backups are exposed, or the workspace is shared, the key can be recovered and abused for unauthorized API usage and billing. The context lowers severity somewhat because local secret files are common in developer workflows, but the omission of safety guidance is still a valid issue.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The example configuration includes an `apiKey` field populated with a realistic secret-shaped value (`sk-xxxxx`) and gives no warning that this value is sensitive or should be sourced securely. In documentation for an agent skill, this can normalize hardcoding credentials into plaintext config files under a home directory, increasing the likelihood of accidental secret exposure via source control, logs, backups, or multi-user systems.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script stores prompt text and timestamps in a local .usage.json file without clear user notice or consent. Prompts may contain sensitive or proprietary content, so retaining them on disk creates a privacy exposure to other local users, backups, or later unintended disclosure.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: User-provided text is sent to a third-party TTS service, which can expose sensitive or proprietary content if users assume local-only processing. In a skill context, this matters because the tool accepts arbitrary text and performs network transmission without an explicit runtime consent or warning at the point of use.

Credential Access

High

• Category: Privilege Escalation

Content

if api_key:
        return api_key
    
    env_file = SKILL_DIR / ".env"
    if env_file.exists():
        for line in env_file.read_text().splitlines():
            if line.startswith("ELEVEN_API_KEY="):

• Confidence: 64% confidence
• Finding: .env"

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.