setup-api-key
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEDATA_EXFILTRATIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill reads the ElevenLabs API key from local environment variables or
.envfiles and sends it to an external server for validation. - The network request is directed to
api.elevenlabs.io, which is the official API endpoint for the skill's author. - [EXTERNAL_DOWNLOADS]: Performs a network GET request to
https://api.elevenlabs.io/v1/userto fetch user account details and confirm the validity of the API key. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local files, creating a potential surface for indirect instructions if the file content is compromised.
- Ingestion points: Reads content from the
.envfile located in the user's project directory (SKILL.md). - Boundary markers: None are used during the file reading process; the skill searches for specific variable patterns.
- Capability inventory: The skill can perform network operations and read local files.
- Sanitization: The skill includes robust behavioral instructions to redact keys if mentioned and strictly forbids asking the user to paste keys into the chat window.
Audit Metadata