registry / @memberjunction/ai-elevenlabs / 5.44.0

@memberjunction/ai-elevenlabs@5.44.0

MemberJunction Wrapper for ElevenLabs Audio Generation

AI Security Review

scanned 18h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. User-invoked realtime sessions can create or PATCH a provider-owned ElevenLabs agent and attach supplied client tools. No install-time execution or local control-surface mutation is present.

Static reason

No blocking static signals were detected.

Trigger

Calling StartSession or CreateClientSession with a non-agent_ model name.

Impact

Changes the caller's ElevenLabs agent configuration and sends session prompt, context, audio, and tool results to that provider.

Mechanism

Runtime ElevenLabs managed-agent provisioning and WebSocket session transport.

Rationale

The package is not malicious, but it has a concrete first-party remote agent lifecycle capability that changes provider-side configuration when explicitly invoked. Policy classifies this as a warning rather than a block.

Evidence

package.jsondist/index.jsdist/elevenLabsRealtime.jsreadme.md

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

dist/elevenLabsRealtime.js creates or updates ElevenLabs managed agents at runtime.

@memberjunction/ai-elevenlabs@5.44.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code