fal-ai-media

Pass

Audited by Gen Agent Trust Hub on Jun 22, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructions guide users to install the fal-ai-mcp-server package via npx. This package is the official tool for interacting with the fal.ai media generation platform.
  • [COMMAND_EXECUTION]: The skill includes a Python example that uses the requests library to perform network operations and writes an audio file (output.mp3) to the local filesystem.
  • [DATA_EXFILTRATION]: The ElevenLabs integration snippet accesses the ELEVENLABS_API_KEY environment variable. This is used to authenticate requests to the official ElevenLabs API endpoint.
  • [DATA_EXFILTRATION]: The upload tool allows the agent to access local files via a user-specified file_path to upload them for processing by the fal.ai service.
  • [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it processes user-provided text for media generation tasks.
  • Ingestion points: User-supplied values for the prompt, text, and file_path parameters across the generate and upload tools.
  • Boundary markers: None present in the instructions.
  • Capability inventory: The skill has the ability to perform network requests, read local files for upload, and write generated media to disk.
  • Sanitization: There are no instructions for sanitizing or escaping user input before it is used in API calls or tool parameters.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 22, 2026, 05:59 AM