create-image-fal
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill accesses a vendor-specific configuration file at
~/.gooseworks/credentials.jsonto retrieve theapi_key,api_base, andagent_idrequired for authenticated proxy requests. This is standard behavior for the vendor's infrastructure. - [COMMAND_EXECUTION]: The
gen_image.pyscript is the primary entry point, processing model specifications and payloads to interact with remote image generation services. - [EXTERNAL_DOWNLOADS]: The skill downloads generated media from the FAL CDN (
*.fal.media) usingurllib.request.urlretrieve. It also uses the Pillow library to transcode these downloads if the file headers do not match the expected extension. - [DATA_EXFILTRATION]: The skill transmits the authentication token and agent metadata to the GooseWorks proxy server (defined in the local config) to facilitate billed API calls.
Audit Metadata