ElevenLabs Music

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 6:26 AM UTC
• Version: 1.0.1

Overview

This skill is a straightforward ElevenLabs music generator, but users should be aware it uses a paid API key and installs Python dependencies at runtime.

Install only if you are comfortable exposing an ElevenLabs API key to this script and paying for generated audio usage. Prefer running it in a limited environment with only the needed ELEVENLABS_API_KEY available, and consider pinning or locking dependencies before repeated use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/generate_music.py:2

Finding

Runtime Resolution of Unpinned Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_music.py, lines 2-8
Vulnerability Type: Unpinned runtime dependencies and unsafe supply-chain resolution
Risk Level: Medium

Vulnerable Code

python

# /// script
# requires-python = ">=3.10"
# dependencies = [
#     "elevenlabs>=1.0.0",
#     "python-dotenv",
# ]
# ///

Technical Analysis

The documented execution method uses uv run, which can resolve and install the inline dependencies when the script is invoked. The elevenlabs dependency specifies only a lower version bound, while python-dotenv has no version constraint. The project contains no reviewed lockfile or package hashes to ensure that the same verified artifacts are installed on every execution.

This allows dependency resolution to select future package versions whose code was not reviewed as part of this audit. Python packages can execute code during installation or import. Both dependencies are imported before the API key is read and used:

python

from elevenlabs.client import ElevenLabs
from dotenv import load_dotenv

load_dotenv()

A compromised package release, registry account, distribution artifact, or transitive dependency could therefore execute with the permissions of the user running the Skill. This is a supply-chain risk; the reviewed source does not itself prove that the current dependency releases are malicious.

Attack Path

1. An attacker compromises a dependency publisher, package distribution artifact, package registry account, or an unconstrained transitive dependency.
2. The attacker publishes a malicious version satisfying elevenlabs>=1.0.0 or any available version selected for unconstrained python-dotenv.
3. A user invokes the Skill through the documented uv run command without locked or frozen dependency resolution.
4. uv resolves and installs the attacker-controlled release.
5. Python imports the dependency, cau ...[truncated 905 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to an exact, reviewed version rather than using a lower bound or no constraint.
2. Generate and commit a uv.lock file covering direct and transitive dependencies.
3. Execute dependency installation and the Skill with locked or frozen resolution so unexpected versions cannot be selected.
4. Require cryptographic package hashes where the packaging workflow supports them.
5. Review dependency updates and their transitive changes before regenerating the lockfile.
6. Use automated dependency vulnerability and provenance scanning in CI.
7. Run the Skill under a least-privileged account or sandbox with access only to the required API credential and intended output directory.
8. Avoid exposing unrelated secrets through the process environment or automatically discovered .env files.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill requires access to a sensitive environment variable (ELEVENLABS_API_KEY) but does not declare an explicit tool scope such as permissions or allowed-tools. This can weaken least-privilege boundaries and make it harder for the hosting agent framework to enforce or audit what capabilities the skill is allowed to use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.