livekit-agents
Audited by Socket on Feb 25, 2026
1 alert found:
AnomalyThis document is a guidance/instruction skill for developers building voice agents with LiveKit Cloud. It requests and expects legitimate credentials (LIVEKIT_URL, LIVEKIT_API_KEY, LIVEKIT_API_SECRET) to be provided by the developer and directs use of official LiveKit documentation and domains. I find no embedded malicious code, no download-execute instructions, nor requests to forward credentials to unknown third parties. The primary risk is operational: developers must protect the required credentials (avoid committing .env files, use secret stores) and must verify APIs against official docs as instructed. Overall this skill is consistent with its stated purpose and is benign, but following it will require handling sensitive credentials correctly in downstream implementation.