Security Audit
Jamkris/everything-gemini-code:skills/fal-ai-media
github.com/Jamkris/everything-gemini-codeTrust Assessment
Jamkris/everything-gemini-code:skills/fal-ai-media received a trust score of 28/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 4 findings: 0 critical, 2 high, 2 medium, and 0 low severity. Key findings include Unpinned `npx` dependency with auto-confirmation, `upload` tool allows arbitrary local file access, Example code exposes API key access pattern.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Static Code Analysis layer scored lowest at 63/100, indicating areas for improvement.
Last analyzed on March 30, 2026 (commit 6c6f43aa). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings4
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unpinned `npx` dependency with auto-confirmation The skill configuration instructs the host system to run `npx -y fal-ai-mcp-server`. The `-y` flag automatically confirms the installation of an unpinned `fal-ai-mcp-server` package. This creates a significant supply chain risk, as a malicious update to `fal-ai-mcp-server` or a typosquatting attack could lead to arbitrary code execution on the host system without user intervention. Pin the version of `fal-ai-mcp-server` (e.g., `fal-ai-mcp-server@1.2.3`) to prevent unexpected updates. Consider using a more controlled installation method that does not automatically confirm package installation from untrusted sources, or ensure `npx` is run in a highly sandboxed environment. | Static | SKILL.md:19 | |
| HIGH | `upload` tool allows arbitrary local file access The `upload` tool is demonstrated with `file_path: "/path/to/image.png"`, implying it can access arbitrary local file paths. If an attacker can control the `file_path` parameter via prompt injection, they could instruct the agent to upload sensitive system files (e.g., `/etc/passwd`, `~/.ssh/id_rsa`, configuration files) to an external service, leading to data exfiltration. Implement strict validation and sandboxing for the `file_path` parameter in the `upload` tool. Restrict file access to a designated, non-sensitive directory, or require explicit user confirmation for file uploads from sensitive locations. | Static | SKILL.md:70 | |
| MEDIUM | Example code exposes API key access pattern The skill documentation includes a Python code snippet demonstrating how to access `os.environ["ELEVENLABS_API_KEY"]` and use it in an API request. While this is a common pattern for secure credential handling, its presence in the untrusted skill description creates a prompt injection risk. If the LLM has a code execution capability and can be prompted to execute this snippet, an attacker could modify the `requests.post` call to log or exfiltrate the `ELEVENLABS_API_KEY` to an attacker-controlled server. Avoid including explicit code snippets that directly access sensitive environment variables or credentials within untrusted skill descriptions. If examples are necessary, use placeholders that prevent actual credential exposure (e.g., `os.environ["<YOUR_API_KEY>"]`) and clearly state that the code is illustrative and not for direct execution by the agent. Ensure the LLM's code execution environment is sandboxed and prevents network access to untrusted destinations. | LLM | SKILL.md:170 | |
| MEDIUM | Potential SSRF via `image_url` and `video_url` parameters The `generate` tool accepts `image_url` and `video_url` parameters for image-to-video and video-to-audio generation. While examples show `<uploaded_url>`, if these parameters can accept arbitrary URLs from user input, an attacker could use them to perform Server-Side Request Forgery (SSRF) attacks. This could allow probing of internal networks, accessing internal services, or potentially exfiltrating data from internal resources. The underlying `fal-ai-mcp-server` should implement strict validation and allowlisting for URLs provided to `image_url` and `video_url`. Only allow URLs from trusted domains or those explicitly generated by the `upload` tool. Prevent access to private IP ranges and internal network resources. | Static | SKILL.md:75 |
Scan History
Embed Code
[](https://skillshield.io/report/87569b7573641cca)
Powered by SkillShield