Skills
skills/gooseworks-ai/goose-skills/create-image-gpt-image-fal/Gen Agent Trust Hub

create-image-gpt-image-fal

Pass

Audited by Gen Agent Trust Hub on Jul 25, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill performs expected operations for image generation, including API communication and file handling. No malicious patterns were detected.
  • [EXTERNAL_DOWNLOADS]: The skill interacts with external services to fulfill its primary function. -- Evidence: scripts/media_proxy.py downloads generated media assets from fal.media domains using standard Python libraries. -- Evidence: The installation instructions in SKILL.md mention a dependency on the fal_client package from official registries.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface common to LLM-powered tools where untrusted input could influence the generation request. -- Ingestion points: The --prompt parameter in scripts/generate.py accepts arbitrary text from the caller. -- Boundary markers: The prompt is sent directly in the JSON payload to the API without delimiters or 'ignore' instructions. -- Capability inventory: The skill can perform network requests and write files (.png, .meta.json) to the local filesystem. -- Sanitization: No specific filtering or escaping of the prompt text is performed before transmission.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 25, 2026, 01:04 PM
Security Audit — agent-trust-hub — create-image-gpt-image-fal