fal-ai-media
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions guide users to install the
fal-ai-mcp-serverpackage vianpx. This package is the official tool for interacting with the fal.ai media generation platform. - [COMMAND_EXECUTION]: The skill includes a Python example that uses the
requestslibrary to perform network operations and writes an audio file (output.mp3) to the local filesystem. - [DATA_EXFILTRATION]: The ElevenLabs integration snippet accesses the
ELEVENLABS_API_KEYenvironment variable. This is used to authenticate requests to the official ElevenLabs API endpoint. - [DATA_EXFILTRATION]: The
uploadtool allows the agent to access local files via a user-specifiedfile_pathto upload them for processing by the fal.ai service. - [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it processes user-provided text for media generation tasks.
- Ingestion points: User-supplied values for the
prompt,text, andfile_pathparameters across thegenerateanduploadtools. - Boundary markers: None present in the instructions.
- Capability inventory: The skill has the ability to perform network requests, read local files for upload, and write generated media to disk.
- Sanitization: There are no instructions for sanitizing or escaping user input before it is used in API calls or tool parameters.
Audit Metadata