elevenlabs-hello-world
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the official ElevenLabs SDKs (@elevenlabs/elevenlabs-js for Node.js and elevenlabs for Python). These are standard libraries for the service.
- [COMMAND_EXECUTION]: Provides cURL commands to interact with the ElevenLabs REST API endpoint (api.elevenlabs.io). This is consistent with the skill's documented purpose.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text to generate audio. While this presents an attack surface for indirect injection, the risk is minimal as the output is a static audio file and is not re-ingested as instructions by the agent.
- [SAFE]: API credentials (ELEVENLABS_API_KEY) are managed via environment variables, which is the recommended safe practice for handling secrets in this context.
Audit Metadata