elevenlabs-core-workflow-b
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npmto install the@elevenlabs/elevenlabs-jslibrary from the official registry and usescurlto interact with ElevenLabs' official API domain (api.elevenlabs.io). These are legitimate actions for the skill's purpose. - [COMMAND_EXECUTION]: The skill utilizes the
Bashtool for package management and performing HTTP requests viacurl. These commands are standard and scoped to the skill's primary function of audio processing. - [DATA_EXFILTRATION]: Audio data and API keys are transmitted to
api.elevenlabs.io. Since this is the intended functionality for an ElevenLabs integration skill and the destination is the official service endpoint, this is considered safe behavior. - [CREDENTIALS_UNSAFE]: The skill correctly instructs the user to store sensitive credentials in an environment variable (
ELEVENLABS_API_KEY) and explicitly warns against hardcoding keys in the source code.
Audit Metadata