Security Audit

elevenlabs-voices

github.com/openclaw/skills

AI SkillCommit 13146e6a3d46

CRITICAL

Scanned 3 months ago

Critical

Immediate action required

High

Priority fixes suggested

Medium

Best practices review

Low

Acknowledged / Tracked

Trust Assessment

elevenlabs-voices received a trust score of 31/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.

SkillShield's automated analysis identified 7 findings: 0 critical, 3 high, 3 medium, and 1 low severity. Key findings include Suspicious import: urllib.request, Potential data exfiltration: file read + network send, Node lockfile missing.

The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Static Code Analysis layer scored lowest at 34/100, indicating areas for improvement.

Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.

Layer Breakdown

Manifest Analysis

100%

Static Code Analysis

34%

Dependency Graph

98%

LLM Behavioral Safety

100%

Behavioral Risk Signals

Network Access

6 findings

Filesystem Write

4 findings

Excessive Permissions

3 findings

Security Findings7

Severity	Finding	Layer	Location
HIGH	Potential data exfiltration: file read + network send Function 'generate_sfx' reads files and sends data over the network. This may indicate data exfiltration. Review this function to ensure file contents are not being sent to external servers.	Static	skills/robbyczgw-cla/elevenlabs-voices/scripts/sfx.py:149
HIGH	Potential data exfiltration: file read + network send Function 'synthesize' reads files and sends data over the network. This may indicate data exfiltration. Review this function to ensure file contents are not being sent to external servers.	Static	skills/robbyczgw-cla/elevenlabs-voices/scripts/tts.py:133
HIGH	Potential data exfiltration: file read + network send Function 'generate_voice_preview' reads files and sends data over the network. This may indicate data exfiltration. Review this function to ensure file contents are not being sent to external servers.	Static	skills/robbyczgw-cla/elevenlabs-voices/scripts/voice-design.py:158
MEDIUM	Suspicious import: urllib.request Import of 'urllib.request' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration.	Static	skills/robbyczgw-cla/elevenlabs-voices/scripts/sfx.py:19
MEDIUM	Suspicious import: urllib.request Import of 'urllib.request' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration.	Static	skills/robbyczgw-cla/elevenlabs-voices/scripts/tts.py:16
MEDIUM	Suspicious import: urllib.request Import of 'urllib.request' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration.	Static	skills/robbyczgw-cla/elevenlabs-voices/scripts/voice-design.py:19
LOW	Node lockfile missing package.json is present but no lockfile was found (package-lock.json, pnpm-lock.yaml, or yarn.lock). Commit a lockfile for deterministic dependency resolution.	Dependencies	skills/robbyczgw-cla/elevenlabs-voices/package.json

Scan History

Embed Code

[![SkillShield](https://skillshield.io/api/v1/badge/53f9ede63f9a0a30.svg)](https://skillshield.io/report/53f9ede63f9a0a30)