speech-to-text
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill correctly implements and recommends environment variable usage for the ElevenLabs API key (ELEVENLABS_API_KEY). It includes explicit warnings against hardcoding secrets and provides a secure architecture for client-side applications by suggesting backend token generation to avoid exposing API keys to the browser.
- [EXTERNAL_DOWNLOADS]: Dependencies are limited to official ElevenLabs libraries (elevenlabs for Python and @elevenlabs/elevenlabs-js for Node.js) and standard utility packages like python-dotenv and pydub. No unverified or suspicious third-party dependencies are requested.
- [DATA_EXFILTRATION]: Network traffic is directed exclusively to the official ElevenLabs API infrastructure (api.elevenlabs.io). Examples using external audio streams (npr-ice.streamguys1.com) are for demonstration purposes and do not involve sensitive data transmission.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted audio and video files for transcription. While this represents a potential injection vector if the resulting text is used to trigger further autonomous agent actions, the skill examples treat the output as inert data, which is standard behavior for transcription tools.
- [COMMAND_EXECUTION]: The skill does not contain any patterns involving arbitrary shell command execution, privilege escalation, or persistence mechanisms.
Audit Metadata