fal-video-edit
Warn
Audited by Gen Agent Trust Hub on Mar 7, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The scripts
edit-video.shandvideo-audio.share vulnerable to command injection via the--add-fal-keyparameter. The script writes the provided input directly into a.envfile (echo "FAL_KEY=$2" > .env) without validation. Because this file is later loaded using thesourcecommand, any shell-executable patterns (such as backticks or command substitution) in the key will be executed in the agent's context. - [EXTERNAL_DOWNLOADS]: The skill uses
curlto interact withhttps://queue.fal.run. This is the official API endpoint for the fal.ai service, which is the service provider for the models used by the skill. These network operations are consistent with the skill's primary function. - [CREDENTIALS_UNSAFE]: The skill implements a plaintext credential storage mechanism. The
FAL_KEYis stored in a local.envfile, making it accessible to any other process or user with access to the skill's directory.
Audit Metadata