fal-restore
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The script
restore.shusescurlto interact with the fal.ai API. It properly quotes its variables when constructing the JSON payload and the command string, which protects against shell command injection from user-supplied arguments. - [EXTERNAL_DOWNLOADS]: The skill makes network requests to
https://fal.run, which is the official API endpoint for the service provider (fal-ai). This is the expected behavior for an API-integrated skill and targets a trusted service domain. - [CREDENTIALS_UNSAFE]: The skill manages its API key (
FAL_KEY) using an environment file (.env). It includes a configuration helper (--add-fal-key) that allows the agent to securely store the key locally rather than hardcoding it or exposing it in process lists via environment variables.
Audit Metadata