generate-voiceover-elevenlabs-v3
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: Audio processing via
ffmpegandffprobeis handled safely in the Python script usingsubprocess.runwith list-based arguments, which avoids shell expansion and command injection vulnerabilities. - [PROMPT_INJECTION]: The skill handles potentially untrusted script text but mitigates indirect injection risks by requiring the agent to display the script for user approval before execution. Additionally, the script uses proper JSON encoding for all API interactions, ensuring the input is treated as data rather than executable instructions.
- [CREDENTIALS_UNSAFE]: The skill manages its API key by reading from a local
.envfile, which is a recommended practice for avoiding hardcoded secrets. While the path used is an absolute local path, this is a configuration preference rather than a security flaw.
Audit Metadata