fal-ai-media
Pass
Audited by Gen Agent Trust Hub on Mar 24, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: Recommends the installation of the
fal-ai-mcp-serverpackage vianpx, which is the standard procedure for deploying the required MCP environment for this skill. - [COMMAND_EXECUTION]: Provides configuration for an MCP server that executes
npxto run the media generation server locally. - [DATA_EXFILTRATION]: Includes a Python example that performs a POST request to
api.elevenlabs.io. ElevenLabs is a well-known service, and the request is used to synthesize speech from text using the user's API key. The snippet correctly utilizes environment variables for key management. - [PROMPT_INJECTION]: The skill processes user-provided prompts and external media URLs (images and videos) for generation tasks. While this constitutes an attack surface for indirect prompt injection, the skill's capabilities are restricted to media generation and standard output operations.
- Ingestion points: User prompts and media URLs (
image_url,video_url) processed by thegenerateanduploadtools. - Boundary markers: None present.
- Capability inventory: Performs network requests to ElevenLabs and writes generated audio files to the local file system.
- Sanitization: No validation or sanitization of input data is described within the instructions.
Audit Metadata