Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Elevenlabs Voice Agent

v1.0.0

Build and manage ElevenLabs Conversational AI voice agents with Twilio phone integration. Use when creating AI phone agents (cold callers, appointment setter...

0· 166·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for boris148/elevenlabs-voice-agent.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Elevenlabs Voice Agent" (boris148/elevenlabs-voice-agent) from ClawHub.
Skill page: https://clawhub.ai/boris148/elevenlabs-voice-agent
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install elevenlabs-voice-agent

ClawHub CLI

Package manager switcher

npx clawhub@latest install elevenlabs-voice-agent
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill's stated purpose is to build/manage ElevenLabs voice agents with Twilio integration — that legitimately requires ElevenLabs API keys and Twilio credentials. However, the registry metadata lists no required environment variables or primary credential. That omission is inconsistent: a manager/automation skill would normally declare the API keys it needs or provide clear instructions for secure provisioning.
Instruction Scope
The SKILL.md stays within the expected domain (ElevenLabs API endpoints, voice/LLM settings, Twilio integration steps, sales-framework guidance). It instructs the operator to obtain Twilio Account SID + Auth Token and to use ElevenLabs APIs, but it does not instruct reading unrelated files or system secrets. Still, it gives no guidance about how credentials should be supplied/stored or used safely, which expands agent discretion.
Install Mechanism
This is an instruction-only skill with no install spec and no code files, so it does not write or execute third-party code on install — that is the lowest risk install profile.
!
Credentials
The runtime instructions reference sensitive credentials (Twilio SID/Auth Token and implicitly an ElevenLabs API key) but the skill declares none. That mismatch is disproportionate: either the skill should list and justify required env vars (and a primary credential), or it should be explicit how/when the agent will request those secrets. Lack of declared credentials makes it unclear how the skill will obtain or use them.
Persistence & Privilege
always is false and the skill is user-invocable only. It does not request persistent system-level privileges or modifications to other skills, so its persistence footprint is minimal.
What to consider before installing
This skill appears to be a how-to for ElevenLabs + Twilio phone agents and is instruction-only (no code), but it does not declare the sensitive credentials it clearly expects you to use. Before installing or running it: 1) ask the publisher (or the marketplace) for a source/homepage and an explicit list of required credentials (ElevenLabs API key, Twilio SID/Auth Token) and how they are expected to be provided; 2) only supply secrets via a secure provisioning method (not pasted into chat); 3) prefer skills that declare required env vars and a primary credential; 4) if you must use it, run it with the least privilege necessary and monitor network calls during initial use. The missing provenance (no homepage/source) and the credentials mismatch are the primary reasons to treat this as suspicious rather than benign.

Like a lobster shell, security has layers — review code before you run it.

latestvk9767a77sncv96hmd6nv2cjd4h83mx34
166downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

ElevenLabs Voice Agent

Build AI phone agents using ElevenLabs Conversational AI API + Twilio.

Setup Flow

  1. Create agent via ElevenLabs dashboard or API
  2. Configure voice, TTS model, LLM, and system prompt
  3. Purchase/connect Twilio phone number via ElevenLabs phone integration
  4. Test and iterate on script, voice settings, turn-taking

Optimal Voice Settings (Proven)

SettingValueWhy
TTS Modelv3 conversationalBest quality for phone calls
Expressive modeONNatural inflection
Stability0.45Natural variation without inconsistency
Similarity0.75Recognizable voice
Speed1.2xFast enough for cold calls (API max)
Streaming latency4Balance speed vs quality
Turn timeout2sDon't wait too long for response
EagernesseagerJump in naturally
Speculative turnONFaster responses
Cascade timeout3sHandle pauses

Recommended Voices

  • Alexandra (kdmDKE6EkgrWrrykO9Qt): Pleasant female, great for cold calls
  • Hope (OYTbf65OHHFELVut7v2H): Warm female backup

LLM Choice

Use gpt-4o-mini for phone agents — speed is critical, latency kills calls.

Key API Endpoints

POST https://api.elevenlabs.io/v1/convai/agents/create
PATCH https://api.elevenlabs.io/v1/convai/agents/{agent_id}
GET https://api.elevenlabs.io/v1/convai/agents/{agent_id}
POST https://api.elevenlabs.io/v1/convai/twilio/phone-numbers — Connect Twilio number

Enable Phone Features

Enable these tools on the agent: voicemail_detection, end_call, background_voice_detection

NEPQ Sales Framework

For appointment-setting agents, use Neuro-Emotional Persuasion Questioning:

  • Permission-based opening ("Do you have a quick moment?")
  • Question-led qualification (don't pitch, ask)
  • Emotional connection questions before booking
  • Soft close with specific time options

Twilio Integration

  1. Get Twilio Account SID + Auth Token
  2. Use ElevenLabs API to create phone number connection
  3. Phone number is provisioned automatically by ElevenLabs
  4. Calls route: Twilio → ElevenLabs → AI agent

Common Issues

  • Robotic voice: Switch to v3 conversational model, enable expressive mode
  • Slow responses: Use gpt-4o-mini, increase streaming latency optimization
  • Cuts off caller: Increase turn timeout, reduce eagerness
  • Sounds scripted: Add personality to system prompt, lower stability slightly

Comments

Loading comments...