fal-ai-media
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security vulnerabilities were detected. The skill's functionality aligns with its stated purpose of media generation.
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to configure the 'fal-ai-mcp-server' using npx, which fetches the official package from the NPM registry.
- [CREDENTIALS_UNSAFE]: Security best practices are followed for credential management. The skill uses placeholders like 'YOUR_FAL_KEY_HERE' and recommends retrieving the ElevenLabs API key from environment variables using 'os.environ' rather than hardcoding secrets.
- [DATA_EXFILTRATION]: The skill includes a Python snippet that makes a POST request to ElevenLabs' official API ('api.elevenlabs.io') to perform text-to-speech synthesis, which is the intended behavior for this functionality.
- [COMMAND_EXECUTION]: The skill uses the 'npx' command to run the fal-ai MCP server, which is a standard execution pattern for Node-based MCP servers.
Audit Metadata