video-model-selection
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch live pricing and model metadata from official endpoints, specifically the fal.ai API. These downloads are restricted to well-known service providers and are used for legitimate configuration and cost-estimation purposes.
- [COMMAND_EXECUTION]: Includes a template for a
curlcommand to retrieve pricing data fromapi.fal.ai. The instructions demonstrate security awareness by explicitly warning the agent never to print or log the authorization header or the secret key ($FAL_KEY). - [INDIRECT_PROMPT_INJECTION]: The skill identifies a potential attack surface where untrusted data could enter the context via external provider schemas or model metadata. It mitigates this by requiring the agent to prioritize official documentation and live callable schemas as the authoritative source of truth, and by requiring explicit user approval for costs and retry limits before execution.
Audit Metadata