High-quality voice synthesis with 18 personas, 32 languages, sound effects, batch processing, and voice design using ElevenLabs API.
Security Analysis
medium confidenceThe skill's code, required env var, and runtime instructions are consistent with a local ElevenLabs TTS/SFX client; it requests the ElevenLabs API key and performs network calls to api.elevenlabs.io, which matches its stated purpose, though there are a few minor documentation/integration inconsistencies and privacy trade-offs you should consider before installing.
Name/description (ElevenLabs TTS/SFX) aligns with the included Python scripts (tts.py, sfx.py, voice-design.py, setup.py) that call ElevenLabs API endpoints. Declared requirement (python3) and declared env var (ELEVEN_API_KEY) are appropriate and necessary for the described functionality.
Runtime instructions and scripts operate within the skill directory and call ElevenLabs endpoints for TTS and sound generation, which is expected. The setup wizard and scripts write local files (config.json, .env, .usage.json) and track usage including truncated prompt text — this is functional for cost tracking but stores user-provided prompts locally. Documentation instructs editing ~/.openclaw/openclaw.json for OpenClaw integration, but the scripts do not appear to parse that file (they only read env vars and a skill-local .env), which is a minor inconsistency between docs and code.
No install spec is provided (instruction-only skill) and the package contains plain Python scripts. There are no remote downloads or archive extracts in the install metadata. This is low risk from an install-mechanism perspective, but note the skill includes executable scripts that will perform network calls when run.
The only secret required is ELEVEN_API_KEY (and an alias ELEVENLABS_API_KEY), which is appropriate for calling the ElevenLabs API. The skill stores the API key locally (config.json/.env) if you run the setup wizard — storing secrets in plaintext is functionally convenient but increases local exposure. The scripts also persist usage records and short prompt excerpts in .usage.json, which may be sensitive depending on your prompts.
The skill does not request elevated system privileges, does not set always:true, and only writes files within the skill directory (config.json, .usage.json, generated audio). That level of persistence is typical and proportional for a CLI-style TTS tool.
Guidance
This skill appears to do what it says: local Python scripts that call ElevenLabs API for TTS and SFX. Before installing or running: 1) Review the code files (they're included) and confirm you trust them — they will send text to api.elevenlabs.io. 2) Prefer setting your ELEVEN_API_KEY as an environment variable rather than saving it in config.json/.env to reduce plaintext credential storage. 3) Be aware the tool stores usage data and truncated prompt text in .usage.json; don't feed confidential text into the tool if you want it to remain private. 4) Documentation mentions OpenClaw integration paths, but the scripts don't parse ~/.openclaw/openclaw.json — expect configuration via env or skill-local .env/config.json. 5) Source/homepage is missing in the registry metadata; if provenance matters to you, obtain the package from a known repository or vendor (or verify the included code) before granting it access to your API key or running it on sensitive data.
Latest Release
v2.1.6
Hardened API key handling and synced OpenClaw metadata/docs.
Popular Skills
Published by @robbyczgw-cla on ClawHub
