fal-ai-media

Pass

Audited by Gen Agent Trust Hub on Mar 24, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Recommends the installation of the fal-ai-mcp-server package via npx, which is the standard procedure for deploying the required MCP environment for this skill.
  • [COMMAND_EXECUTION]: Provides configuration for an MCP server that executes npx to run the media generation server locally.
  • [DATA_EXFILTRATION]: Includes a Python example that performs a POST request to api.elevenlabs.io. ElevenLabs is a well-known service, and the request is used to synthesize speech from text using the user's API key. The snippet correctly utilizes environment variables for key management.
  • [PROMPT_INJECTION]: The skill processes user-provided prompts and external media URLs (images and videos) for generation tasks. While this constitutes an attack surface for indirect prompt injection, the skill's capabilities are restricted to media generation and standard output operations.
  • Ingestion points: User prompts and media URLs (image_url, video_url) processed by the generate and upload tools.
  • Boundary markers: None present.
  • Capability inventory: Performs network requests to ElevenLabs and writes generated audio files to the local file system.
  • Sanitization: No validation or sanitization of input data is described within the instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 24, 2026, 07:42 AM
Security Audit — agent-trust-hub — fal-ai-media