pronounce-button
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script (
generate-pronunciation.py) to interface with the ElevenLabs API. This is the primary function of the skill and uses standard argument parsing for terms, output paths, and voice settings. - [EXTERNAL_DOWNLOADS]: The Python script makes POST requests to the official ElevenLabs API (
api.elevenlabs.io) to fetch audio data. This is a well-known service and the interaction is limited to the skill's intended purpose. - [CREDENTIALS_UNSAFE]: The skill correctly instructs the user to provide the
ELEVENLABS_API_KEYvia an environment variable and explicitly warns against hardcoding or committing the key. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided terms and filenames. While it interpolates these into command lines and markdown files, it employs a
slugifyfunction to sanitize filenames and uses standard JSON encoding for API payloads, which mitigates common injection risks.
Audit Metadata