generate-image
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads generated images from fal.ai CDN URLs. This is the primary intended function of the skill and uses the official provider's infrastructure.
- [CREDENTIALS_UNSAFE]: The skill uses an API key (
FAL_KEY) for authentication. It follows safe practices by instructing users to store this key in a local.envfile (which is excluded via.env.example) or environment variables. The script specifically includes a rule to never print or log the API key value. - [COMMAND_EXECUTION]: The script uses Bun's native APIs and standard library for file operations (reading/writing images and JSON configs) and network requests. It does not spawn arbitrary shell commands or execute untrusted code.
- [DATA_EXFILTRATION]: Network operations are restricted to official fal.ai domains (
api.fal.ai,queue.fal.run,rest.fal.ai) for the purpose of image generation and management. No sensitive user data is sent to unauthorized third parties.
Audit Metadata