Skills
Navigate
skills/podo/design-agent-skills/fal-ai-skills/Gen Agent Trust Hub

fal-ai-skills

Fail

Audited by Gen Agent Trust Hub on Oct 22, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill body and metadata (stub.yaml) contain instructions to install a CLI tool by piping a remote script to a shell: curl https://genmedia.sh/install -fsS | bash. This execution method is insecure as it allows for arbitrary code execution from a remote source without verification of the script's content.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of 16 additional skills from the GitHub repository fal-ai-community/skills using the npx skills add command. This involves fetching external code and configurations from a repository that is not part of the standard trusted environment.
  • [COMMAND_EXECUTION]: The SKILL.md file includes a "Decision tree" consisting of several shell commands (e.g., checking for file existence with [ -f "$f" ], searching for patterns with grep, and checking directory existence with [ -e ... ]). These are designed to be run by the agent to automate the setup process.
Recommendations
  • HIGH: Downloads and executes remote code from: https://genmedia.sh/install - DO NOT USE without thorough review
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Oct 22, 2026, 09:34 PM