sound-effects

Pass

Audited by Gen Agent Trust Hub on Nov 4, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing vendor-owned packages and tools from official sources. This includes Python packages from PyPI, Node.js packages from the NPM registry, and installation scripts hosted on the vendor's GitHub repository (github.com/elevenlabs).
  • [REMOTE_CODE_EXECUTION]: Provides a shell installer command (curl | sh) to install the ElevenLabs CLI. This script is sourced from the vendor's official release page on GitHub. It also suggests using npx to execute the vendor's onboarding tool, which downloads and runs the latest version of the CLI.
  • [COMMAND_EXECUTION]: The skill uses various package managers (npm, pip, brew, scoop) and shell commands to perform authentication and sound generation. These operations are consistent with the skill's stated purpose of providing a developer interface for the ElevenLabs API.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text descriptions to generate audio content.
  • Ingestion points: The text parameter in convert method calls within Python, JavaScript, and CLI examples (SKILL.md).
  • Boundary markers: None identified in the provided examples.
  • Capability inventory: Performs external API calls to ElevenLabs and writes generated binary audio data to local files (e.g., thunder.mp3) in SKILL.md.
  • Sanitization: None described; however, the impact is limited to the audio generation output.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 4, 2026, 10:49 PM