architect-create-client-tool
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides procedural guidance for interacting with the ElevenLabs API at
api.elevenlabs.io. This is an official vendor domain and falls within the expected behavior for a tool-management skill. - [SAFE]: Sensitive data such as API keys are handled via placeholders (
$API_KEY), which is a secure practice for documentation and instruction templates. - [SAFE]: The skill mentions client-side code execution, but this refers to the functionality of the ElevenLabs SDK in the user's own application, not the execution of arbitrary or malicious code by the agent skill itself.
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read data from the ElevenLabs API (agent configurations and existing tool lists) to inform its actions. While this creates a theoretical ingestion surface, the risk is negligible as it involves structured data from the official service provider.
Audit Metadata