Security audit
Security checks for vulnerabilities and agentic risk
The skill advertises a Mistral-only orchestrator but the code also uses other paid AI services and stores child-related story data with too little disclosure or control.
Review before installing. Only deploy this behind authentication, quotas, and clear retention controls, and disclose or remove the ElevenLabs, Tavily, Gemini, database, and prompt-cache behavior. Avoid running it in an environment where unrelated provider keys are present unless those integrations are intentionally enabled.
scripts/orchestrator.py:236Unauthenticated endpoints can consume privileged third-party services and persistent storage
SKILL.md:10Declared permissions omit third-party credentials, outbound services, and sensitive data flows
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
if not ELEVENLABS_API_KEY:
return {"error": "ELEVENLABS_API_KEY not set"}
try:
r = httpx.post(f"https://api.elevenlabs.io/v1/text-to-speech/{voice_id}",
headers={"xi-api-key": ELEVENLABS_API_KEY, "Content-Type": "application/json"},
json={"text": text, "model_id": "eleven_multilingual_v2",
"voice_settings": {"stability": 0.6, "similarity_boost": 0.8}},
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
if not ELEVENLABS_API_KEY:
return {"error": "ELEVENLABS_API_KEY not set"}
try:
r = httpx.post("https://api.elevenlabs.io/v1/sound-generation",
headers={"xi-api-key": ELEVENLABS_API_KEY, "Content-Type": "application/json"},
json={"text": prompt, "duration_seconds": min(duration_seconds, 22)},
timeout=30)
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
if not ELEVENLABS_API_KEY:
return {"error": "ELEVENLABS_API_KEY not set"}
try:
r = httpx.post("https://api.elevenlabs.io/v1/sound-generation",
headers={"xi-api-key": ELEVENLABS_API_KEY, "Content-Type": "application/json"},
json={"text": f"Gentle lullaby music: {prompt}", "duration_seconds": min(duration_seconds, 22)},
timeout=30)
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
if not TAVILY_API_KEY:
return {"error": "TAVILY_API_KEY not set"}
try:
r = httpx.post("https://api.tavily.com/search",
json={"api_key": TAVILY_API_KEY, "query": query, "max_results": 3}, timeout=15)
if r.status_code == 200:
return {"results": [{"title": x.get("title",""), "snippet": x.get("content","")[:200]} for x in r.json().get("results",[])]}
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
for i in range(min(len(scenes), 4)):
art_prompt = img_prompts.get(f"scene_{i}", f"Dreamy watercolor: {scenes[i][:100]}")
try:
resp = hx.post(
f"https://generativelanguage.googleapis.com/v1beta/models/gemini-2.0-flash-exp:generateContent?key={gemini_key}",
json={"contents": [{"parts": [{"text": art_prompt}]}],
"generationConfig": {"responseModalities": ["TEXT", "IMAGE"]}},
The declared purpose and required secret mention only Mistral orchestration, but the analyzed behavior reportedly includes additional third-party services, extra API keys, persistence, caching, and a domain-specific story pipeline. This mismatch is dangerous because it can hide the true attack surface, cause operators to grant insufficiently reviewed secrets and network access, and enable undisclosed data flows to external services or storage.
A skill described as Mistral orchestration also loads unrelated ElevenLabs and Tavily credentials, enabling access to additional external services not justified by the stated purpose. Hidden credential dependencies enlarge blast radius, increase supply-chain trust requirements, and can enable unexpected data sharing and billing abuse.
The skill metadata presents this as a Mistral multi-agent orchestration capability, but the code also implements audio generation, web search, and later image-generation support. This scope expansion increases attack surface and can surprise deployers by causing external data transfers and costs beyond what the manifest implies.
The code conditionally invokes Gemini to generate illustrations, which is materially outside the declared Mistral orchestration scope. This creates an undisclosed external dependency and transmits derived story content to Google, increasing privacy, cost, and policy risk without clear consent.
The skill declares environment and outbound network requirements in metadata but does not define an explicit tool scope such as permissions or allowed-tools. That creates an authorization gap where consumers may not clearly understand or constrain what the skill is allowed to access, increasing the chance of overbroad execution in hosts that rely on manifest-level scoping.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
if not ELEVENLABS_API_KEY:
return {"error": "ELEVENLABS_API_KEY not set"}
try:
r = httpx.post(f"https://api.elevenlabs.io/v1/text-to-speech/{voice_id}",
headers={"xi-api-key": ELEVENLABS_API_KEY, "Content-Type": "application/json"},
json={"text": text, "model_id": "eleven_multilingual_v2",
"voice_settings": {"stability": 0.6, "similarity_boost": 0.8}},
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
if not ELEVENLABS_API_KEY:
return {"error": "ELEVENLABS_API_KEY not set"}
try:
r = httpx.post(f"https://api.elevenlabs.io/v1/text-to-speech/{voice_id}",
headers={"xi-api-key": ELEVENLABS_API_KEY, "Content-Type": "application/json"},
json={"text": text, "model_id": "eleven_multilingual_v2",
"voice_settings": {"stability": 0.6, "similarity_boost": 0.8}},
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
if not ELEVENLABS_API_KEY:
return {"error": "ELEVENLABS_API_KEY not set"}
try:
r = httpx.post(f"https://api.elevenlabs.io/v1/text-to-speech/{voice_id}",
headers={"xi-api-key": ELEVENLABS_API_KEY, "Content-Type": "application/json"},
json={"text": text, "model_id": "eleven_multilingual_v2",
"voice_settings": {"stability": 0.6, "similarity_boost": 0.8}},
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
if not ELEVENLABS_API_KEY:
return {"error": "ELEVENLABS_API_KEY not set"}
try:
r = httpx.post("https://api.elevenlabs.io/v1/sound-generation",
headers={"xi-api-key": ELEVENLABS_API_KEY, "Content-Type": "application/json"},
json={"text": prompt, "duration_seconds": min(duration_seconds, 22)},
timeout=30)
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
if not ELEVENLABS_API_KEY:
return {"error": "ELEVENLABS_API_KEY not set"}
try:
r = httpx.post("https://api.elevenlabs.io/v1/sound-generation",
headers={"xi-api-key": ELEVENLABS_API_KEY, "Content-Type": "application/json"},
json={"text": prompt, "duration_seconds": min(duration_seconds, 22)},
timeout=30)
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
if not ELEVENLABS_API_KEY:
return {"error": "ELEVENLABS_API_KEY not set"}
try:
r = httpx.post("https://api.elevenlabs.io/v1/sound-generation",
headers={"xi-api-key": ELEVENLABS_API_KEY, "Content-Type": "application/json"},
json={"text": prompt, "duration_seconds": min(duration_seconds, 22)},
timeout=30)
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
if not TAVILY_API_KEY:
return {"error": "TAVILY_API_KEY not set"}
try:
r = httpx.post("https://api.tavily.com/search",
json={"api_key": TAVILY_API_KEY, "query": query, "max_results": 3}, timeout=15)
if r.status_code == 200:
return {"results": [{"title": x.get("title",""), "snippet": x.get("content","")[:200]} for x in r.json().get("results",[])]}
User prompts and child identifiers are sent to Mistral and ElevenLabs during planning, story generation, and narration without any disclosure or consent handling in this file. Because the content may involve minors and personalized details, undisclosed third-party transmission is more sensitive than in a generic text-processing skill.
Scene-derived content and illustration prompts are sent to Gemini for image generation without user-facing notice. Even though the prompts are model-generated, they still encode story content tied to a child-focused workflow and therefore represent undisclosed external sharing.
The endpoint stores generated stories, child names, language, and cached media artifacts in a database, but persistence is not disclosed in the skill description. Undisclosed storage of child-associated content creates privacy, retention, and compliance risk, especially in a bedtime-story context involving minors.
The docstring states 'Direct chat with any Mistral Agent via Conversations API,' which implies arbitrary Mistral agent access. In practice, the code only accepts agent names found in the hardcoded AGENTS mapping and rejects all others as unknown.