create-video-fal
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides the
gen_video.pyscript, which serves as a command-line interface for agents to execute video generation tasks. - [EXTERNAL_DOWNLOADS]: The skill uses
urllib.request.urlretrieveto download generated media from public FAL media URLs to a local destination specified by the user. - [PROMPT_INJECTION]: The skill processes potentially untrusted data through its generation payload, creating an attack surface for indirect prompt injection.
- Ingestion points: The
--payloadargument ingen_video.pyaccepts either raw JSON strings or local file paths (using the@prefix). - Boundary markers: There are no explicit delimiters or instructions in the code to isolate or ignore instructions embedded within the user-provided prompt strings.
- Capability inventory: The skill possesses file-writing capabilities (downloading media and persisting job state in
~/.gooseworks/pending-fal-jobs/) and network access (communicating with the vendor-managed API proxy and media CDNs). - Sanitization: While the script performs standard JSON parsing, it does not validate or sanitize the internal content of the generation prompts before forwarding them to the external API.
Audit Metadata