The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted audio data via external URLs and local paths, which are then processed by tools like speechToText and speechToSpeech. This represents a standard surface for indirect prompt injection where malicious instructions could be embedded in the audio content and returned to the agent's context in the form of transcripts.
Ingestion points: The audio_url and audio_path parameters in scripts/speechToText.ts, scripts/speechToSpeech.ts, and scripts/isolateAudio.ts allow for the ingestion of arbitrary external audio content.
Boundary markers: The connector returns results in structured JSON (e.g., { "text": "..." }), but does not include explicit boundary markers or safety warnings for the agent within the transcripts themselves.
Capability inventory: The skill is limited to making authenticated requests to api.elevenlabs.io and performing local file operations (reading/writing audio files).
Sanitization: The connector relies on the ElevenLabs API for processing; it does not perform separate validation or sanitization of the audio content before or after processing.
[DATA_EXPOSURE]: The skill provides the ability to read local files through the audio_path parameter. While intended for processing audio files generated by other tools, this capability could theoretically be used to access other files if the agent's environment is not sufficiently restricted.
Evidence: lib/audioInput.ts uses readFile(source.audio_path) to load content for processing in tools such as isolateAudio and speechToSpeech.
[SAFE_PRACTICE]: The skill documentation includes specific guidance for the agent to safely check for the presence of environment variables (credentials) using commands that only list variable names rather than their values, which helps prevent accidental leakage of secrets into the chat transcript.

elevenlabs