narova-elevenlabs

Pass

Audited by Gen Agent Trust Hub on Aug 16, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes ffmpeg via subprocess.run to convert downloaded MP3 audio to mono WAV files. This is the primary and expected function of the worker and is implemented safely without shell invocation or unsanitized user input in the command arguments.
  • [EXTERNAL_DOWNLOADS]: The worker makes network requests to https://api.elevenlabs.io to fetch voice lists and synthesize audio. These operations are essential for the skill's purpose and target a well-known service domain.
  • [CREDENTIALS_UNSAFE]: The skill requires ELEVENLABS_API_KEY to function. The implementation correctly instructs users to manage this via environment variables and ensures the key is only transmitted in the xi-api-key header, with explicit checks to prevent leaking it in logs or error responses.
  • [DATA_EXFILTRATION]: No evidence of sensitive local file access or unauthorized data exfiltration was found. The skill only transmits synthesis text and configuration options to the official ElevenLabs API.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 16, 2026, 02:58 AM
Security Audit — agent-trust-hub — narova-elevenlabs