media-forge
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script uses
process.argvto parse command-line flags and arguments for provider settings and prompts. While it executes within the Bun environment, it does not invoke arbitrary shell commands viaexecorspawn; it strictly uses built-in Node.js/Bun modules andfetchfor network communication with defined API providers. - [EXTERNAL_DOWNLOADS]: The skill downloads generated media files from Replicate or fal.ai URLs to a local directory (
.genfeed/artifactsby default). These downloads are the intended primary purpose of the skill and originate from established AI model providers. - [CREDENTIALS_SAFE]: The skill requires
REPLICATE_API_TOKENandFAL_KEYto be present in the environment. It correctly handles these as in-memory variables and explicitly avoids writing them to disk, which aligns with security best practices for credential management in agent skills.
Audit Metadata