fal-gamedev

Pass

Audited by Gen Agent Trust Hub on May 1, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the genmedia CLI to interface with the fal.ai platform for image generation, background removal, and asset management. It also uses mkdir to establish a local directory structure for project assets.
  • [EXTERNAL_DOWNLOADS]: Asset downloads are performed via the --download flag of the vendor's CLI tool, saving generated content to a local ./game-assets/ directory.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses a potential attack surface by interpolating user-supplied character descriptions into shell commands.
  • Ingestion points: User-provided character descriptions and image inputs within SKILL.md.
  • Boundary markers: Absent; user strings are concatenated directly into prompt arguments.
  • Capability inventory: Shell execution capabilities for genmedia run and genmedia status across all recipes in SKILL.md.
  • Sanitization: No explicit sanitization or escaping is defined for the user input before its inclusion in the command string.
Audit Metadata
Risk Level
SAFE
Analyzed
May 1, 2026, 09:29 PM