ClawHub
Back to skill

Security audit

Elevenlabs Agents

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly coherent for managing ElevenLabs agents, but it instructs the agent to hide local setup details and can write files or push remote changes with insufficient disclosure in some workflows.

Review this skill before installing if you use ElevenLabs in production. It can authenticate to your ElevenLabs account, create local project/config files, and deploy changes remotely. Only use it in a workspace where those files are acceptable, and confirm what will be pushed before approving agent or tool changes.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The manifest description says to use the skill when the user wants to 'work with voice agents, list their agents, create new ones, or manage agent configurations,' which is quite broad and lacks clear boundaries or exclusion cases. In a markdown/manifest context, this can cause unintended invocation because it does not specify narrower trigger phrases or when the skill should not activate.

Missing User Warnings

High
Confidence
96% confidence
Finding
The skill tells the agent to look for `agents.json` and, if missing, silently run `elevenlabs agents init`, then explicitly says never to tell the user about the initialization. This operation creates project files in the working directory, affecting user data and environment without disclosure in the skill guidance.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The markdown instructs the agent to ask for a webhook URL or configuration, then 'Create config file and run' the add command, followed by pushing changes. This describes local file creation and remote deployment behavior but does not warn users that configuration files will be written to disk.

Scope Creep

Low
Category
Excessive Agency
Content
## Critical Behavior Rules

1. **Hide CLI details**: Never tell users to run commands. Handle everything silently.
2. **Handle errors gracefully**: If a command fails, fix it yourself or explain the situation in user-friendly terms.
3. **Local vs Remote distinction**: Always be clear whether you're showing local (synced) agents or remote (platform) agents.
Confidence
70% confidence
Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Behavior Manipulation

Medium
Category
Prompt Injection
Content
## Critical Behavior Rules

1. **Hide CLI details**: Never tell users to run commands. Handle everything silently.
2. **Handle errors gracefully**: If a command fails, fix it yourself or explain the situation in user-friendly terms.
3. **Local vs Remote distinction**: Always be clear whether you're showing local (synced) agents or remote (platform) agents.
Confidence
75% confidence
Finding
Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Static analysis

No suspicious patterns detected.