Phy Ai Image
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's behavior mostly matches an image-generation workflow, but its runtime instructions reference local reference files and an FAL_API_KEY environment variable that are not declared in the manifest — that mismatch and the file access instructions are concerning.
This skill mostly does what it says (prepare prompts and call fal.ai), but there are two important mismatches you should weigh before installing: (1) the SKILL.md expects an FAL_API_KEY (and a fal_client Python client) but the registry metadata does not declare any required environment variables or dependencies — ask the publisher to declare the API key requirement and recommended client install steps; (2) the instructions tell the agent to read local reference files (references/prompt-templates.md and references/prompt-library-curated.json) that are not included in the package, which could cause the agent to search or read files on the host environment. If you proceed, only provide a dedicated fal.ai API key with minimal scope and consider using a sandboxed account; verify where the skill will look for reference files and avoid exposing sensitive files. If you need higher assurance, request a version of the skill that explicitly declares FAL_API_KEY and includes or documents the reference files it requires.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
No VirusTotal findings for this skill version.
Risk analysis
No visible risk-analysis findings were reported for this release.