Elevenlabs Pro

ElevenLabs advanced TTS for converting text to speech, listing voices, and managing credits

This skill does what it says (calls ElevenLabs API and writes audio files), but the registry metadata omits the required ELEVENLABS_API_KEY credential even though both SKILL.md and the included Python script require it. Because the package source is 'unknown', verify the origin before installing. If you install: (1) only provide a minimal-scope ElevenLabs API key (rotate it if compromised), (2) run the script in an isolated environment or container, (3) inspect the included scripts yourself (you already have them) and confirm network calls go only to api.elevenlabs.io, and (4) avoid pasting high-privilege credentials into third-party skills from unknown publishers. If you need higher assurance, ask the publisher to declare the required env var in the registry and provide a trusted homepage or source repository.

Type: OpenClaw Skill Name: openclaw-skill-elevenlabs-pro Version: 0.1.0 The `scripts/elevenlabs.py` file contains a path traversal vulnerability. The `output` argument, which specifies the output MP3 file path, is not sanitized, allowing an attacker to potentially write files to arbitrary locations on the file system (e.g., `../../../../tmp/malicious.mp3`). This is a critical vulnerability that could lead to unauthorized file modification or creation, but it does not demonstrate clear malicious intent such as data exfiltration to an attacker-controlled server or the installation of backdoors. No prompt injection attempts were found in `SKILL.md`.