elevenlabs-setup-api-key
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses the
ELEVENLABS_API_KEYfrom the environment or a local.envfile. This credential is used to perform a validation check against the official ElevenLabs API (https://api.elevenlabs.io/v1/user). As this operation targets the official domain of the service for which the key is intended, it represents standard authentication behavior for a setup skill. - [CREDENTIALS_UNSAFE]: The skill follows secure credential management practices by instructing users to save keys to a local
.envfile rather than pasting them into the prompt. It also mandates the redaction of the key in any output or verification records. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources such as environment variables and
.envfiles. - Ingestion points: Accesses
ELEVENLABS_API_KEYfrom the local environment and.envfile inSKILL.md. - Boundary markers: The skill contains explicit instructions to redact the key and warns the user not to paste it into the chat interface.
- Capability inventory: The agent is authorized to make network requests to the official ElevenLabs API for credential validation.
- Sanitization: The instructions require the agent to never print, quote, or repeat the key in chat or logs.
Audit Metadata