ElevenLabs STT OpenClaw

• Analyzed: May 11, 2026, 4:45 AM
• Findings: 1
• Version: 1.2.2
• Hash: 15bd3f161e58e1d29deb1946a73ff8091f21bd8128460dd203cf46e753db4b78
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is designed for ElevenLabs Speech-to-Text transcription and exhibits no malicious intent. It correctly uses environment variables for API keys, validates user-provided URLs and JSON inputs, and employs `subprocess.Popen` with lists of arguments to prevent shell injection. The `ALLOW_LOCAL_FILE=true` requirement for local file access is a good security practice. While transcribed audio could theoretically contain malicious instructions, the skill itself only outputs or speaks this text, not executes it, making any downstream risk a vulnerability of the consuming agent, not the skill. All network calls are confined to the ElevenLabs API.