Is elevenlabs-voices safe?
https://clawhub.ai/robbyczgw-cla/elevenlabs-voices
This ElevenLabs TTS skill provides legitimate voice synthesis functionality with clean documentation and no prompt injection. However, filesystem monitoring during installation reveals concerning access to sensitive files (AWS credentials, SSH host keys, agent auth profiles) that have no relationship to TTS functionality. While no network exfiltration was observed and canary files remained intact, the pattern of repeated sensitive file reads represents a meaningful security risk, particularly in multi-skill environments where credential exposure could be exploited by other components.
Category Scores
Findings (13)
HIGH Sensitive file access during install: AWS credentials and SSH keys -40 ▶
Filesystem monitoring captured reads of ~/.aws/credentials, /etc/ssh/ssh_host_rsa_key, and /etc/ssh/ssh_host_rsa_key.pub during the skill installation phase. These files contain cloud provider secrets and host SSH private keys. No TTS skill should require access to AWS credentials or SSH host keys.
HIGH Access to auth-profiles.json containing agent credentials -18 ▶
The install process read ~/.openclaw/agents/main/agent/auth-profiles.json, which likely contains OAuth tokens, API keys, and authentication profiles for the agent's connected services. This file is not referenced anywhere in the skill's source code.
MEDIUM Repeated systematic reads of user profile and config files -35 ▶
The monitoring log shows 5+ repeated cycles of reading ~/.openclaw/openclaw.json, ~/.profile, and ~/.bashrc in rapid succession. While individual reads could be normal config lookup, the repeated pattern suggests enumeration or scanning behavior rather than a single purposeful read.
MEDIUM Python scripts with broad filesystem and network access -18 ▶
The skill includes 4 Python scripts that use urllib.request for HTTP calls and pathlib/os for filesystem access. While these are used for legitimate ElevenLabs API calls, they provide arbitrary HTTP and filesystem capabilities when the agent executes them. The scripts read API keys from multiple locations including environment variables and config files.
MEDIUM Setup wizard creates persistent credential file -10 ▶
setup.py creates config.json containing the user's ElevenLabs API key in plaintext. While documented and expected, this creates a persistent credential file in the skill directory that other skills or processes could read.
LOW Reads .env file for API key extraction -5 ▶
Scripts read the skill-local .env file line by line looking for ELEVEN_API_KEY. If the .env file contains other secrets (database passwords, other API keys), those lines are loaded into memory during the read. The code only extracts the matching key, but memory exposure is possible.
INFO SKILL.md is clean documentation with no hidden directives 0 ▶
The SKILL.md file contains straightforward TTS documentation with voice tables, CLI usage examples, and configuration instructions. No prompt injection patterns, hidden instructions, or agent manipulation attempts were found.
INFO Triggers are appropriately scoped to TTS functionality 0 ▶
The trigger phrases ('use voice', 'speak as', 'list voices', 'voice settings', 'generate sound effect', 'design a voice') are all directly related to the skill's stated TTS purpose and do not attempt to hijack unrelated agent commands.
LOW Skill suggests modifying OpenClaw global config -5 ▶
SKILL.md instructs users to modify ~/.openclaw/openclaw.json to add TTS configuration including an API key. While this is standard integration documentation, it encourages placing credentials in a shared config file accessible to all skills.
INFO All canary files passed integrity check 0 ▶
Honeypot files placed as fake .env, SSH keys, and AWS credentials were not modified or tampered with during the audit.
LOW Temporary files created in /tmp during install -10 ▶
Lock file and jiti cache files were created in /tmp/openclaw-1000/ and /tmp/jiti/ during install. These appear to be from the OpenClaw runtime (gateway lock, CJS module compilation) rather than from the skill itself, but they indicate code execution occurred during the install process.
MEDIUM Skill could enable two-stage credential exfiltration -30 ▶
The combination of sensitive file reads (AWS creds, SSH keys, auth profiles) during install and the skill's ability to make HTTP requests to ElevenLabs API creates a potential two-stage attack vector. A malicious version could read credentials during install and exfiltrate them via API call parameters or custom endpoints disguised as ElevenLabs requests.
LOW Pronunciation dictionary could be used for social engineering -5 ▶
The pronunciations.json file replaces words before sending to TTS. A malicious update could replace benign words with misleading content (e.g., replacing 'safe' with 'dangerous' in spoken output), though this is a low-probability attack vector.