music
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill interacts with the official ElevenLabs infrastructure for its primary functionality.
- Fetches music generation and upload services from the official ElevenLabs API domain (
api.elevenlabs.io). - Recommends the installation of official client libraries from the NPM registry (
@elevenlabs/elevenlabs-js) and PyPI (elevenlabs). - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied natural language prompts and structured composition plans which could potentially include instructions from untrusted sources if the agent is processing external data.
- Ingestion points: The
promptandcomposition_planparameters inSKILL.mdandreferences/api_reference.mdare the primary entry points for external data. - Boundary markers: The skill instructions do not specify explicit delimiters for user input, relying instead on ElevenLabs' internal content filtering mentioned in the 'Content Restrictions' section.
- Capability inventory: The skill utilizes standard file system operations (
fs.createWriteStreamin JavaScript,open()in Python) to save generated audio files and makes network requests viacurland official SDKs. - Sanitization: No explicit sanitization or validation of the prompt content is performed within the skill instructions beyond the service provider's own safety checks.
Audit Metadata