elevenlabs-local-dev-loop
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill follows security best practices by instructing users to store API keys in a
.env.localfile and includes it in the.gitignorerecommendations within the project structure. - [SAFE]: External dependencies are limited to well-known packages (@elevenlabs/elevenlabs-js, vitest, tsx) from a trusted service provider and established development toolsets.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided text for speech synthesis, creating an ingestion surface. This is evaluated as safe given the local development context and restricted capabilities.
- Ingestion points: Input text processed in
src/elevenlabs/tts.tsandtests/tts.test.ts. - Boundary markers: None used for the content to be synthesized.
- Capability inventory: Local file system writes to an
output/directory and network requests to the official ElevenLabs API. - Sanitization: The skill does not implement sanitization for the input text, which is typical for this application type.
Audit Metadata