The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/realtime.sh executes shell commands including curl for network requests and jq for parsing JSON responses.
[DATA_EXFILTRATION]: The skill transmits user-provided image prompts and the FAL_KEY to the fal.ai API at https://fal.run. This is the intended behavior for the skill.
[SAFE]: The script implements a mechanism to store the FAL_KEY in a local .env file, which aligns with standard environment variable management practices.
[SAFE]: The skill contains a surface for indirect prompt injection due to its handling of user input.
Ingestion points: User input is ingested via the --prompt argument in scripts/realtime.sh.
Boundary markers: No markers are present to isolate user input from the JSON structure.
Capability inventory: The skill performs external network operations using curl.
Sanitization: User input is directly interpolated into the JSON payload string without escaping or validation, which may lead to malformed API requests if the prompt contains control characters like double quotes.

fal-realtime