narova-elevenlabs
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
ffmpegviasubprocess.runto convert downloaded MP3 audio to mono WAV files. This is the primary and expected function of the worker and is implemented safely without shell invocation or unsanitized user input in the command arguments. - [EXTERNAL_DOWNLOADS]: The worker makes network requests to
https://api.elevenlabs.ioto fetch voice lists and synthesize audio. These operations are essential for the skill's purpose and target a well-known service domain. - [CREDENTIALS_UNSAFE]: The skill requires
ELEVENLABS_API_KEYto function. The implementation correctly instructs users to manage this via environment variables and ensures the key is only transmitted in thexi-api-keyheader, with explicit checks to prevent leaking it in logs or error responses. - [DATA_EXFILTRATION]: No evidence of sensitive local file access or unauthorized data exfiltration was found. The skill only transmits synthesis text and configuration options to the official ElevenLabs API.
Audit Metadata