Agent Economy ReportAgent Economy ReportCAUTION version 1.0.0 · audited 2026-09-17
This skill tells an AI agent how to install and use a command-line program named sag that converts text into spoken audio using ElevenLabs. It requires an ElevenLabs API key and can install sag from a third-party Homebrew tap, which is not pinned to a version. The instructions include running shell commands such as sag -v Clawd -o /tmp/voice-reply.mp3 and attaching the resulting audio file to a reply. The skill card explicitly warns that the installer is third-party and that text is sent to ElevenLabs for speech generation. No hidden downloader, credential exfiltration, persistence, or prompt-injection content was found. It is not clearly malicious, but a user should review the installer and use a limited, revocable API key.
| Declared purpose | ElevenLabs text-to-speech with mac-style say UX. The skill is for generating ElevenLabs TTS audio, previewing voices, and producing local MP3 voice replies from text. |
| Observed behavior | The skill instructs the agent to install sag from a third-party Homebrew tap, run sag CLI commands with an ElevenLabs API key, generate an MP3 at /tmp/voice-reply.mp3, and include that media path in replies. It does not contain executable code beyond documentation and bash examples. |
| Verdict, rules only | SAFE |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| install_packages | needed | SKILL.md line 5 metadata includes a Homebrew install for formula steipete/tap/sag, which would download and install the third-party sag CLI. |
| shell | needed | SKILL.md line 49 opens a bash code block and line 51 runs a sag CLI shell command to generate audio. |
| credentials | needed | The skill requires ELEVENLABS_API_KEY or SAG_API_KEY for the CLI, as stated in SKILL.md lines 12-14. |
| network | needed | The CLI sends text to ElevenLabs for speech generation; skill-card.md line 28 states this. The skill files do not show a direct ElevenLabs URL. |
| filesystem_write | needed | The command on SKILL.md line 51 writes an MP3 file locally to /tmp/voice-reply.mp3. |
| severity | finding |
|---|---|
| medium | Unpinned third-party Homebrew tap install The skill metadata declares an install step using brew formula steipete/tap/sag. This downloads and executes third-party code without a version pin, so the installed CLI could change later. SKILL.md:5 metadata: {"clawdbot":{"emoji":"🗣️","requires":{"bins":["sag"],"env":["ELEVENLABS_API_KEY"]},"primaryEnv":"ELEVENLABS_API_KEY","install":[{"id":"brew","kind":"b |
| medium | Requires ElevenLabs API credential The skill needs the ELEVENLABS_API_KEY environment variable; the CLI uses it to authenticate to ElevenLabs. This grants the installed sag CLI access to the key. SKILL.md:13 - `ELEVENLABS_API_KEY` (preferred) |
| low | Alternative API key variable The CLI also accepts SAG_API_KEY. This is an additional credential path but not a separate malicious behavior. SKILL.md:14 - `SAG_API_KEY` also supported by the CLI |
| info | Bash shell instruction block The skill instructs the agent to run commands in bash. The actual command is shown on line 51. SKILL.md:49 ```bash |
| medium | Shell execution and local MP3 file write This command runs the third-party sag CLI, supplies the message text, and writes /tmp/voice-reply.mp3. It combines shell execution, file write, and sending text to the CLI's speech service. SKILL.md:51 sag -v Clawd -o /tmp/voice-reply.mp3 "Your message here" |
| info | Instructs including generated media file The agent is told to include the generated audio file in its reply. SKILL.md:54 # MEDIA:/tmp/voice-reply.mp3 |
| info | Author-disclosed installer risk The publisher's own risk statement confirms the Homebrew tap and CLI install are unpinned and third-party. skill-card.md:24 Risk: The skill relies on an unpinned third-party Homebrew tap and sag CLI install. |
| medium | Text and API key sent to speech service The skill card confirms the sag CLI sends the supplied text to ElevenLabs. Users should avoid sending sensitive text and use a revocable key. skill-card.md:28 Risk: The CLI requires an ElevenLabs API key and sends text for speech generation. |
| info | Recommended mitigation for API key and text handling This is a disclosure rather than malicious behavior, but it highlights the third-party data flow. skill-card.md:30 Mitigation: Use a revocable, limited API key where possible and avoid sending sensitive text unless you trust the CLI and ElevenLabs handling of that text. |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:9 |
| sag.sh | not in the service index | SKILL.md:4 |
| Binaries invoked | bash |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 0 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 62 | e9a062586db13baf… |
_meta.json | 6 | 49da791daa38ac7a… |
skill-card.md | 54 | b0aafdef619f3cfc… |
For agents
JSON: https://agenteconomy.report/k/sag.audit.json · badge: https://agenteconomy.report/k/sag.audited.svg ·
skill rating: /k/sag · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).