fal
Pass
Audited by Gen Agent Trust Hub on Apr 17, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes standard system utilities including curl, jq, and xargs to interact with external APIs. These tools are used as intended for data retrieval and processing without evidence of malicious command injection.
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for downloading generated media from fal.run, which is the official domain of the Fal.ai service. Analysis confirms that these downloads are directed to temporary storage and are not executed as code, making the automated scan alert a false positive.
- [CREDENTIALS_UNSAFE]: Security best practices are followed regarding authentication; the skill instructs users to provide their API token via a shell environment variable (FAL_TOKEN) rather than hardcoding sensitive credentials.
- [DATA_EXFILTRATION]: Network operations are restricted to communication with legitimate Fal.ai endpoints. No patterns were detected suggesting the unauthorized access or transmission of sensitive local files or environment data.
Audit Metadata