ClawHub

Sag

v1.0.0

ElevenLabs text-to-speech with mac-style say UX.

⭐ 21· 21.6k·1.1k current·1.2k all-time
byPeter Steinberger@steipete
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
ℹ
Purpose & Capability
The SKILL.md clearly implements an ElevenLabs TTS wrapper (requires a sag CLI and an ELEVENLABS_API_KEY), which is coherent with the skill name/description. However the registry-level requirements claimed 'none' for env vars and install, which conflicts with SKILL.md metadata that lists bins and ELEVENLABS_API_KEY — this mismatch is suspicious (likely packaging/metadata error) and should be resolved.
✓
Instruction Scope
The instructions are narrowly scoped to generating TTS via the sag CLI, writing an output file (e.g., /tmp/voice-reply.mp3), and returning it. They do not instruct reading unrelated files or exfiltrating other environment variables. They reference additional optional env names (SAG_API_KEY, ELEVENLABS_VOICE_ID/SAG_VOICE_ID) which are relevant to TTS usage.
ℹ
Install Mechanism
The SKILL.md metadata suggests installing via a Homebrew formula from the steipete/tap (third‑party) tap. A Homebrew formula is an expected install path for a CLI, but using a third‑party tap carries some risk — and the registry metadata omitted this install spec, creating an inconsistency that should be checked against the homepage/source.
✓
Credentials
Requested credentials (ELEVENLABS_API_KEY; optional SAG_API_KEY and voice ID vars) are proportional to an ElevenLabs TTS client. There are no unrelated credential requests. The inconsistency is that registry metadata declares no required env vars while SKILL.md expects an API key.
✓
Persistence & Privilege
The skill does not request always:true or any elevated/persistent platform privileges. It's user-invocable and uses the CLI at invocation time; autonomous invocation remains possible (platform default) but is not combined with other high-risk flags.
What to consider before installing
Before installing or providing an API key: (1) Verify the source code/homepage (https://sag.sh) and that the Homebrew formula (steipete/tap/sag) is legitimate; (2) Favor creating a scoped ElevenLabs API key (minimal permissions) if possible; (3) Be cautious about installing a CLI from a third‑party Homebrew tap — review the formula and its upstream repo; (4) Note the registry metadata and SKILL.md disagree about required env/install information — ask the publisher to correct metadata or provide the source; (5) If you do install, confirm the sag binary's behavior locally before supplying secrets to an agent, and only grant the ELEVENLABS_API_KEY to environments you trust.

Like a lobster shell, security has layers — review code before you run it.

latestvk970m68xhvmgd7ymkj47p1379x7ykaav

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🗣️ Clawdis
Binssag
EnvELEVENLABS_API_KEY
Primary envELEVENLABS_API_KEY

Install

Install sag (brew)
Bins: sag
brew install steipete/tap/sag

Comments