Skillv1.0.0

ClawScan security

ElevenLabs Open Account · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignFeb 11, 2026, 8:55 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: This is an instruction-only skill that consistently guides a user through signing up for ElevenLabs and obtaining an API key; it requests no credentials, runs no installs, and stays within its stated purpose.
Guidance: This skill is a straightforward, instruction-only guide for creating an ElevenLabs account and getting an API key. A few practical notes before installing or using it: (1) the sign-up link in the skill is an affiliate/referral URL—if you prefer, open elevenlabs.io directly to avoid referral tracking; (2) the skill never asks for or stores your API key, but do not paste secrets into chat—store keys in environment variables or a secrets manager and give them only to trusted services; (3) when you create API keys, apply least privilege, set usage/billing limits if available, and rotate keys regularly; (4) because the skill can be invoked normally by the agent (disable-model-invocation is false), ensure you trust any agent that will be guided to create or use keys—this skill itself does not exfiltrate secrets.

Purpose & Capability: okThe name/description match the content: the skill only documents how to open an ElevenLabs account, where to find API keys, and how to store them. It does not request unrelated capabilities or credentials.
Instruction Scope: okSKILL.md only provides step-by-step signup and API-key retrieval guidance and includes safe storage advice. It does not instruct the agent to read local files, environment variables, or to transmit secrets to external endpoints.
Install Mechanism: okThere is no install spec and no code files; this is instruction-only, so nothing is written to disk or downloaded during installation.
Credentials: okThe skill declares no required environment variables or credentials. The advice to store the API key in an environment variable (example: ELEVENLABS_API_KEY) is appropriate and proportionate to the purpose.
Persistence & Privilege: okThe skill is not forced always-on (always:false) and uses normal model invocation. It does not request system-wide configuration changes or persistent privileges.