elevenlabs
Pass
Audited by Gen Agent Trust Hub on Apr 5, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The script scripts/dialogs.py uses ffmpeg to process audio files, and scripts/sfx.py uses afplay to play audio clips. Both scripts pass arguments as a list to subprocess.run, which is a safe practice that prevents shell injection.
- [EXTERNAL_DOWNLOADS]: The skill communicates with the official ElevenLabs API (api.elevenlabs.io) to generate audio and manage voices. This network activity is necessary for the skill's primary function.
- [PROMPT_INJECTION]: The skill processes untrusted input data (text prompts and JSON scripts) which could theoretically contain instructions. Ingestion points: scripts/dialogs.py (JSON input), scripts/music.py (prompt). Boundary markers: None. Capability inventory: subprocess calls (ffmpeg, afplay), network operations, and file writing. Sanitization: None. These inputs are primarily used for audio synthesis via an external API.
- [SAFE]: The script scripts/quota.py attempts to load environment variables from a .env file in the user's home directory. This is standard practice for managing API keys in CLI tools and does not constitute a security risk.
Audit Metadata