fal-ai-media

SUSPICIOUS: The skill's purpose is coherent, but its actual trust boundary is not. It presents fal.ai media generation while directing users to an unpinned community MCP package that receives the FAL_KEY, instead of fal.ai's documented official MCP endpoint. Data flows are mostly expected for this use case, but install provenance and credential forwarding make the skill medium-high risk rather than benign.