create-image-fal

Pass

Audited by Gen Agent Trust Hub on Aug 10, 2026

Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [CREDENTIALS_UNSAFE]: The skill accesses a vendor-specific configuration file at ~/.gooseworks/credentials.json to retrieve the api_key, api_base, and agent_id required for authenticated proxy requests. This is standard behavior for the vendor's infrastructure.
  • [COMMAND_EXECUTION]: The gen_image.py script is the primary entry point, processing model specifications and payloads to interact with remote image generation services.
  • [EXTERNAL_DOWNLOADS]: The skill downloads generated media from the FAL CDN (*.fal.media) using urllib.request.urlretrieve. It also uses the Pillow library to transcode these downloads if the file headers do not match the expected extension.
  • [DATA_EXFILTRATION]: The skill transmits the authentication token and agent metadata to the GooseWorks proxy server (defined in the local config) to facilitate billed API calls.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 10, 2026, 02:58 PM
Security Audit — agent-trust-hub — create-image-fal