setup-api-key
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides a legitimate workflow for ElevenLabs API key configuration. It verifies keys against the official api.elevenlabs.io endpoint, which is a well-known service.
- [SAFE]: Storing keys in a .env file is a standard security practice for local tool configuration and is not considered a credential exposure vulnerability.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user input to be saved as a credential. 1. Ingestion points: User input for the API key in SKILL.md. 2. Boundary markers: The agent waits for user input after the request. 3. Capability inventory: Network validation (GET) and file writing (.env). 4. Sanitization: Verification via the official API service ensures the input is a valid key.
Audit Metadata