skills/genfeedai/skills/media-forge/Gen Agent Trust Hub

media-forge

Pass

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The script uses process.argv to parse command-line flags and arguments for provider settings and prompts. While it executes within the Bun environment, it does not invoke arbitrary shell commands via exec or spawn; it strictly uses built-in Node.js/Bun modules and fetch for network communication with defined API providers.
  • [EXTERNAL_DOWNLOADS]: The skill downloads generated media files from Replicate or fal.ai URLs to a local directory (.genfeed/artifacts by default). These downloads are the intended primary purpose of the skill and originate from established AI model providers.
  • [CREDENTIALS_SAFE]: The skill requires REPLICATE_API_TOKEN and FAL_KEY to be present in the environment. It correctly handles these as in-memory variables and explicitly avoids writing them to disk, which aligns with security best practices for credential management in agent skills.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 4, 2026, 06:43 PM
Security Audit — agent-trust-hub — media-forge