elevenlabs

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:52 AM UTC
• Version: 0.2.9

Overview

This skill is a coherent ElevenLabs-through-RunAPI workflow, with expected API use, file upload, and result download behavior that users should handle carefully.

Install only if you are comfortable using RunAPI and ElevenLabs for the media you provide. Use a trusted RunAPI CLI install, keep API keys scoped, avoid sending private media unless intended, and save downloaded outputs to a controlled directory.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13
• Finding: Unpinned Executable Installed from a Third-Party Homebrew Tap<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 13-17 **Vulnerability Type**: Unpinned third-party dependency from a mutable package source **Risk Level**: Medium ### Vulnerable Code ```yaml install: - kind: brew formula: runapi-ai/tap/runapi bins: - runapi ``` ### Technical Analysis The skill directs the environment to install the `runapi` executable from the third-party Homebrew tap `runapi-ai/tap`. No package version, immutable source revision, cryptographic checksum, or signature is specified. Consequently, installation resolves whatever formula and package version the tap serves at installation time. If the tap, its publishing credentials, its upstream release location, or the referenced artifact is compromised, the installed executable or Homebrew installation logic could differ from the version originally reviewed. Because the skill subsequently relies on `runapi` for authentication, local-file uploads, paid task submission, and result retrieval, a compromised executable would operate in a sensitive position and could access data supplied to the CLI. ### Attack Path 1. An attacker compromises the third-party Homebrew tap, its release infrastructure, or package-publishing credentials. 2. The attacker changes the formula or referenced binary to a malicious version. 3. A user installs the skill dependency using the unpinned formula. 4. Homebrew retrieves and installs the attacker-controlled version. 5. When the agent invokes `runapi`, the malicious executable runs with the privileges of the invoking user. 6. It can inspect CLI arguments, environment variables, configuration files, authentication material, and media files provided during the workflow. 7. It may transmit accessible information externally or manipulate API requests and returned artifacts. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the account installing or invoking the CLI. The affected scope may in ...[truncated 532 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to a specific reviewed release rather than resolving the latest mutable formula. 2. Bind installation to an immutable source commit or versioned artifact. 3. Verify a publisher signature or documented cryptographic checksum before installing or executing the binary. 4. Document the canonical source repository and expected release publisher. 5. Prefer a trusted package source with provenance attestations and reproducible release artifacts. 6. Where Homebrew cannot enforce the required immutable version, provide a verification step that downloads a specific release and checks its SHA-256 digest before execution. 7. Run the CLI with least privilege and limit its access to credentials and local files that are necessary for the current task. 8. Review dependency updates before changing the pinned version. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:77
• Finding: Unsafe Shell Substitution of Response-Derived Download Values<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 77-83 **Vulnerability Type**: Potential shell command and option injection through unquoted remote values **Risk Level**: Medium ### Vulnerable Code ```shell curl --fail --location <deliverable-url> --output <downloaded-file> for file in <downloaded-files>; do expected_mime=<expected-MIME-or-family-pattern-for-this-file> test -s "$file" [[ "$(file --brief --mime-type "$file")" == $expected_mime ]] done ``` ### Technical Analysis The skill instructs the agent to derive deliverable URLs from a remote API response and substitute them into a shell command. The URL, output filename, file list, and expected MIME pattern are represented as unquoted placeholders. If an implementation replaces these placeholders by constructing shell source text, shell metacharacters, whitespace, substitutions, redirections, or option-like values could alter command interpretation. Quoting only the later uses of `$file` does not protect the initial `curl` command, the `for` list, or the assignment to `expected_mime`. The template is documentation rather than directly executable source, so exploitation depends on an agent or generated implementation performing literal textual substitution. Nevertheless, the instructions do not require argument-array execution, strict URL validation, safe local filename generation, or rejection of shell metacharacters. A compromised service, intercepted response, or maliciously controlled result URL could therefore reach a shell-command construction boundary without adequate validation. Following redirects with `--location` also permits navigation to an unexpected host unless the destination scheme and host are validated. ### Attack Path 1. An attacker compromises the remote API response path or otherwise causes a crafted deliverable URL or related response value to be returned. 2. The response includes shell-significant characters, an option-like value, an unexpected ...[truncated 1410 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not generate shell source by replacing placeholders with response-derived values. 2. Pass URLs, paths, and MIME values as distinct argument-array elements through an execution API that does not invoke a shell. 3. If a shell is unavoidable, store each value in a safely populated variable and quote every expansion: ```shell curl --fail --location --output "$downloaded_file" -- "$deliverable_url" ``` 4. Generate local output filenames independently rather than deriving them directly from remote URL path components. 5. Restrict output files to a dedicated directory, resolve the canonical path, and verify that the result remains inside that directory. 6. Require HTTPS and allowlist expected deliverable hosts. Validate every redirect destination rather than trusting unrestricted cross-host redirects. 7. Reject URLs containing control characters and reject unsupported schemes, embedded credentials, or malformed hostnames. 8. Store downloaded paths in a shell array and iterate with quoted array expansion: ```shell for file in "${downloaded_files[@]}"; do test -s "$file" || exit 1 done ``` 9. Validate expected MIME values against a fixed allowlist such as `audio/*` or an exact contract-derived MIME type; do not interpolate arbitrary patterns into shell syntax. 10. Run downloads with least privilege and prevent overwriting existing files unless explicitly authorized. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The skill explicitly instructs the agent to download external media URLs and write them to local files, but it does not require an explicit user confirmation or warning before performing those filesystem and network actions. In an agent setting, this can cause unexpected local side effects, consume disk/network resources, and fetch untrusted remote content even when the user did not clearly authorize file creation.

Static analysis

No suspicious patterns detected.