Audio Content Generator

PassAudited by ClawScan on May 1, 2026.

Overview

The skill’s audio-generation workflow is coherent and user-approved, but it relies on external API keys, an ElevenLabs data flow, and a local helper dependency that users should understand before use.

This skill appears safe for its stated purpose if you trust the referenced local TTS helper and intend to use Anthropic and ElevenLabs credentials. Review the script before approving audio generation, and do not include sensitive personal or business information unless you are comfortable sending it to ElevenLabs.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

Using the skill may consume Anthropic or ElevenLabs account quota and depends on credentials supplied in the environment.

Why it was flagged

The skill explicitly requires provider API keys. This is expected for Claude/ElevenLabs audio generation, but it gives the workflow access to account credentials and possible quota or billing usage.

Skill content

"requires":{"skills":["sag"],"env":["ANTHROPIC_API_KEY","ELEVENLABS_API_KEY"]},"primaryEnv":"ANTHROPIC_API_KEY"

Recommendation

Use scoped, revocable API keys where possible and confirm that both providers are intended for the content being generated.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

The visible skill is instruction-only, but the actual MP3 generation is performed by a separate local helper.

Why it was flagged

Audio generation depends on a local helper script from the `sag` skill path. The helper is not part of this one-file manifest, so users are trusting that installed dependency.

Skill content

uv run /home/clawdbot/clawdbot/skills/sag/scripts/tts.py

Recommendation

Install or use this only in an environment where the referenced `sag` helper is trusted and kept up to date.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Topics, prompts, or script text may be sent to ElevenLabs for audio generation.

Why it was flagged

The generated script is passed to the TTS workflow for conversion by ElevenLabs. This provider data flow is disclosed and purpose-aligned, but the script content may include user-provided details.

Skill content

ElevenLabs converts it to high-quality audio ... "[formatted_script]"

Recommendation

Avoid including confidential, regulated, or private information in scripts unless you are comfortable sending that content to the TTS provider.