fal-gamedev
Pass
Audited by Gen Agent Trust Hub on May 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
genmediaCLI to interface with the fal.ai platform for image generation, background removal, and asset management. It also usesmkdirto establish a local directory structure for project assets. - [EXTERNAL_DOWNLOADS]: Asset downloads are performed via the
--downloadflag of the vendor's CLI tool, saving generated content to a local./game-assets/directory. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a potential attack surface by interpolating user-supplied character descriptions into shell commands.
- Ingestion points: User-provided character descriptions and image inputs within SKILL.md.
- Boundary markers: Absent; user strings are concatenated directly into prompt arguments.
- Capability inventory: Shell execution capabilities for
genmedia runandgenmedia statusacross all recipes in SKILL.md. - Sanitization: No explicit sanitization or escaping is defined for the user input before its inclusion in the command string.
Audit Metadata