ClawHub
Back to skill

Security audit

ElevenLabs STT OpenClaw

Security checks for vulnerabilities and agentic risk

Overview

This speech-to-text skill is not clearly malicious, but it deserves review because it can stream live microphone audio to ElevenLabs and exposes sensitive data in subprocess arguments.

Install only if you are comfortable sending audio and possible transcript content to ElevenLabs and any configured webhook endpoint. Avoid live-listen or always-on microphone mode around private conversations, and prefer using a restricted ElevenLabs API key on a single-user machine because the current scripts can expose the key through process arguments.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/transcribe.sh:135
Finding

ElevenLabs API Key Exposed Through curl Process Arguments

Content
View full analysis
` in its argument vector. 3. A local attacker or monitoring component with permission to inspect the process command line observes the running `curl` process. 4. The observer extracts the ElevenLabs API key from the header argument. 5. The recovered key is used to make unauthorized ElevenLabs API requests. Exploitation depends on the operating system's process-visibility policy and the attacker's local privileges. ### Impact Assessment A successful attacker obtains the authority associated with the exposed ElevenLabs API key. This may permit unauthorized API usage, consumption of account quotas or credits, and access to any ElevenLabs operatio ...[truncated 92 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/realtime.sh:31
Finding

ElevenLabs API Key Exposed Through websocat Process Arguments

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/_realtime_stream.py:34
Finding

API Key Exposed in Realtime STT and TTS Subprocess Arguments

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/_realtime_stream.py:53
Finding

Generated TTS Audio Persistently Left in the Temporary Directory

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (29)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 18)May include surrounding context.

md
- **Cloud URL input** (`--url https://...`) for hosted files
- **Advanced controls**: timestamps granularity, entity detection, keyterms, multi‑channel
- **Concurrency‑safe** via a filesystem lock (no parallel requests)
- **No .env sourcing** — reads only explicit environment variables

---

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documented --on-transcript option allows arbitrary shell commands to run on each final transcript, creating a powerful execution primitive unrelated to basic STT. If transcripts contain attacker-influenced or unexpected content and are interpolated into shell commands, this can lead to command injection, data exfiltration, or unsafe automation.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The documented purpose emphasizes batch transcription of local audio files, but the skill also includes interactive live listening and always-on/toggle microphone behavior. In this context, undisclosed capture of ambient audio materially increases privacy risk because microphone access can collect far more sensitive data than a user-selected file upload.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The documented purpose emphasizes batch transcription of local audio files, but the skill also includes interactive live listening and always-on/toggle microphone behavior. In this context, undisclosed capture of ambient audio materially increases privacy risk because microphone access can collect far more sensitive data than a user-selected file upload.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The documented purpose emphasizes batch transcription of local audio files, but the skill also includes interactive live listening and always-on/toggle microphone behavior. In this context, undisclosed capture of ambient audio materially increases privacy risk because microphone access can collect far more sensitive data than a user-selected file upload.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md
- Live listener mode is available via `scripts/live_listen.sh` with toggle/always-on modes and optional TTS response.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README presents the skill as a local audio transcription tool, but later documents realtime microphone capture, TTS playback, and transcript-driven hooks that materially expand its capabilities. This mismatch increases the risk of users enabling continuous audio capture or downstream actions they did not expect from the stated skill purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README describes live microphone streaming, cloud URL input, and webhook-based result delivery, but does not clearly warn that audio and transcripts are sent to external services and may contain sensitive information. In a speech tool, this omission is significant because users may unintentionally transmit private conversations, regulated data, or internal content off-device.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill declares required binaries and an API key but does not declare an explicit tool scope such as allowed-tools or permissions. That omission weakens transparency and policy enforcement, making it easier for a caller to invoke shell and environment-backed capabilities without a clearly bounded contract.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill describes webhook use, URL-based input, realtime streaming, and an external API key, but it does not clearly warn users that audio content and optional metadata will be transmitted to third-party services. In a speech-transcription context, this is sensitive because audio may contain personal, confidential, or regulated information, and webhook metadata can leak identifiers or workflow details.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This script performs continuous microphone capture and streams live audio to a remote service, which materially exceeds the stated skill purpose of transcribing local audio files. That mismatch is dangerous because users may invoke a file-transcription skill without expecting live environment capture or outbound transmission of ambient speech.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Invoking local executables for microphone capture and network streaming goes beyond a typical file-transcription workflow and introduces additional privacy-sensitive capabilities. In the context of a skill advertised for local CLI file transcription, this hidden capability is more dangerous because it can capture and export live conversation unexpectedly.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/_realtime_stream.py (reported line 32)May include surrounding context.

python
"-f", "avfoundation", "-i", DEVICE,
    "-ac", "1", "-ar", str(sample_rate), "-f", "s16le", "pipe:1"
]
ffmpeg = subprocess.Popen(ffmpeg_cmd, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL)

# websocat websocket
ws = subprocess.Popen([

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The code captures microphone audio and immediately streams it to an external speech-to-text service without any user-facing warning or consent flow. This is dangerous because it can expose private conversations, background speech, or sensitive workplace information to a third party under a misleading file-transcription label.

Content

No source excerpt is available for this finding.

Tainted flow: 'ffmpeg_cmd' from os.environ.get (line 27, credential/environment) → subprocess.Popen (code execution)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/_realtime_stream.py (reported line 32)May include surrounding context.

python
"-f", "avfoundation", "-i", DEVICE,
    "-ac", "1", "-ar", str(sample_rate), "-f", "s16le", "pipe:1"
]
ffmpeg = subprocess.Popen(ffmpeg_cmd, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL)

# websocat websocket
ws = subprocess.Popen([

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/_realtime_stream.py (reported line 35)May include surrounding context.

python
ffmpeg = subprocess.Popen(ffmpeg_cmd, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL)

# websocat websocket
ws = subprocess.Popen([
    "websocat", WS_URL, "-t", "-H", f"xi-api-key: {API_KEY}"
], stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, text=True)

Tainted flow: 'API_KEY' from os.environ.get (line 8, credential/environment) → subprocess.Popen (code execution)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/_realtime_stream.py (reported line 35)May include surrounding context.

python
ffmpeg = subprocess.Popen(ffmpeg_cmd, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL)

# websocat websocket
ws = subprocess.Popen([
    "websocat", WS_URL, "-t", "-H", f"xi-api-key: {API_KEY}"
], stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, text=True)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script adds text-to-speech synthesis and local audio playback, behavior not described in a speech-to-text skill focused on transcribing audio files. Scope expansion like this increases attack surface and can surprise users by speaking remote or transcribed content aloud, creating privacy and social-engineering risks.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/_realtime_stream.py (reported line 50)May include surrounding context.

python
def tts_say(text):
    # Use -- to avoid option injection
    subprocess.Popen(["say", "--", text])


def tts_elevenlabs(text):

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/_realtime_stream.py (reported line 61)May include surrounding context.

python
tmp.close()
    tts_cmd = [
        "curl", "-s", "-X", "POST",
        f"https://api.elevenlabs.io/v1/text-to-speech/{VOICE_ID}/stream",
        "-H", f"xi-api-key: {API_KEY}",
        "-H", "Content-Type: application/json",
        "-d", json.dumps({"text": text})

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/transcribe.sh (reported line 138)May include surrounding context.

sh
tmp.close()
    tts_cmd = [
        "curl", "-s", "-X", "POST",
        f"https://api.elevenlabs.io/v1/text-to-speech/{VOICE_ID}/stream",
        "-H", f"xi-api-key: {API_KEY}",
        "-H", "Content-Type: application/json",
        "-d", json.dumps({"text": text})

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/_realtime_stream.py (reported line 67)May include surrounding context.

python
"-d", json.dumps({"text": text})
    ]
    with open(tmp.name, "wb") as f:
        subprocess.run(tts_cmd, stdout=f, stderr=subprocess.DEVNULL)

    # Validate MP3 header (avoid AudioFileOpen errors on bad payloads)
    try:

Tainted flow: 'tts_cmd' from os.environ.get (line 59, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/_realtime_stream.py (reported line 67)May include surrounding context.

python
"-d", json.dumps({"text": text})
    ]
    with open(tmp.name, "wb") as f:
        subprocess.run(tts_cmd, stdout=f, stderr=subprocess.DEVNULL)

    # Validate MP3 header (avoid AudioFileOpen errors on bad payloads)
    try:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/_realtime_stream.py (reported line 77)May include surrounding context.

python
head = f.read(3)
        if head not in (b"ID3", b"\xff\xfb", b"\xff\xf3", b"\xff\xf2"):
            return False
        subprocess.Popen(["afplay", tmp.name])
        return True
    except Exception:
        return False

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This script is explicitly designed to capture microphone audio and send it to ElevenLabs for realtime speech-to-text, but it does not provide a clear user-facing disclosure at runtime that spoken audio will leave the local machine and be transmitted to a third-party service. In a live-listening tool, that omission can cause users to unknowingly expose sensitive conversations, credentials, or regulated data during use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.