elevenlabs-agents
Pass
Audited by Gen Agent Trust Hub on Mar 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes official ElevenLabs SDKs and tools from public registries, including @elevenlabs/react, @elevenlabs/client, @elevenlabs/agents-cli, and @elevenlabs/elevenlabs-js. It also references an official embeddable widget from elevenlabs.io.
- [COMMAND_EXECUTION]: Shell scripts provided (e.g., create-agent.sh, deploy-agent.sh, test-agent.sh) facilitate agent management using the official ElevenLabs CLI. These scripts are transparent and perform standard deployment and testing operations.
- [CREDENTIALS_UNSAFE]: No hardcoded credentials were found. The skill uses environment variables (e.g., ELEVENLABS_API_KEY) and placeholder secret variables (e.g., {{secret__api_key}}) for secure configuration management.
- [PROMPT_INJECTION]: The skill includes dedicated sections and guides for system prompt engineering with a focus on implementing security guardrails to prevent unauthorized model behavior and data leakage.
- [DATA_EXFILTRATION]: Network communication is directed toward official ElevenLabs API endpoints (api.elevenlabs.io). Examples for external tools use standard placeholders for third-party services like Stripe and Salesforce.
- [REMOTE_CODE_EXECUTION]: No patterns of executing untrusted remote code (such as curl-to-bash from unknown sources) were detected.
Audit Metadata