setup-api-key

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly asks the user to paste their ElevenLabs API key into the chat and instructs the agent to include that key verbatim in validation headers and in a .env file, which requires the LLM to handle and output secret values directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The runtime workflow only reads first-party user-provided API key text from the conversation while validating it via fixed endpoints (GET https://api.elevenlabs.io/v1/user) rather than ingesting outsider-authored free text from an external feed/queue without selection.