corespeed-studio

• Outcome: Review
• Latest audit: Sep 14, 2026 · 9:09 PM UTC
• Version: 1.0.0

Overview

This is a coherent fal.ai media-generation skill, but it needs review because its helper can write downloaded remote output to arbitrary writable paths and call unbounded endpoints.

Review this skill before installing. Only use it with a fal.ai API key you are comfortable exposing to this runtime, avoid sensitive prompts or media unless you intend to send them to fal.ai, use a dedicated output directory, and avoid arbitrary endpoints or filenames outside that directory. Publisher-side fixes should add endpoint and download allowlists, constrain output paths, and pin or lock runtime dependencies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: scripts/fal.py:2

Finding

Unpinned Runtime Dependencies Permit Unreviewed Supply-Chain Changes

Content

View full analysis

=3.10" # dependencies = [ # "fal-client>=0.5.0", # ] # /// ``` The documentation also states: ```markdown `uv run` automatically creates an isolated virtual environment and installs the `fal-client` dependency on first run. ``` ### Technical Analysis The installation command retrieves the latest available `uv` package without an exact version or integrity hash. The PEP 723 metadata similarly specifies `fal-client>=0.5.0`, allowing any current or future package version satisfying that constraint. Consequently, the code reviewed in this audit does not fully determine the code that will execute at runtime. Package installation and module import may execute package-controlled code with the same permissions as the Agent. An upstream compromise, malicious release, dependency compromise, or unexpected incompatible update could therefore alter behavior after the Skill has been reviewed. No evidence was found that the currently named packages are intentionally malicious. The vulnerability is the absence of dependency immutability and integrity controls. ### Attack Path 1. An attacker compromises a permitted dependency release or one of its transitive dependencies. 2. The compromised release remains compatible with the unconstrained `uv` installation or the `fal-client>=0.5.0` requirement. 3. A user installs or invokes the Skill. 4. `pip` or `uv run` resolves and installs the compromised package version. 5. Package installation or import executes attacker-controlled code in the ...[truncated 712 chars]

Remediation

View remediation

=0.5.0` in runtime metadata. 6. Perform dependency updates through a controlled review process rather than resolving new versions automatically during Skill execution. 7. Run dependency installation and media processing in a sandbox with minimal filesystem and environment-variable access. 8. Add automated software-composition analysis and package-integrity checks to the release process. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fal.py:118

Finding

Unrestricted Model Endpoint and Unvalidated Remote Output Download

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/fal.py:80

Finding

Caller-Controlled Output Path Allows Arbitrary File Overwrite

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill invokes a Python script that uses an API key and communicates with fal.ai, but the manifest does not declare an explicit tool/permission scope for environment access or network egress. This weakens platform-level guardrails and makes it easier for the skill to perform external requests or consume secrets without clear review or user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill encourages users to submit prompts, images, audio, and video to fal.ai, but it does not clearly warn that this content is transmitted to a third-party external service. Users may unknowingly send sensitive media, personal data, or confidential prompts off-platform, creating privacy, compliance, and data-handling risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation describes an image_url parameter for image editing but does not warn that supplying a URL causes the referenced image to be fetched and transmitted to an external third-party service. This can lead users to unknowingly send sensitive, private, or regulated images off-platform, creating privacy, confidentiality, and compliance risks. In a media-generation skill that encourages editing user-provided assets, this omission is more dangerous because users are likely to upload or reference personal content.

Content

No source excerpt is available for this finding.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration
• Confidence: 55% confidence

Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · scripts/fal.py (reported line 99)May include surrounding context.

python

uploaded.append(fpath)
                print(f"Using URL: {fpath}")
            else:
                url = fal_client.upload_file(fpath)
                uploaded.append(url)
                print(f"Uploaded: {fpath} → {url}")

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration
• Confidence: 55% confidence

Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · scripts/fal.py (reported line 114)May include surrounding context.

python

uploaded.append(fpath)
                print(f"Using URL: {fpath}")
            else:
                url = fal_client.upload_file(fpath)
                uploaded.append(url)
                print(f"Uploaded: {fpath} → {url}")

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file includes code that sends user-supplied data to fal.ai via fal_client.subscribe, but the surrounding documentation does not disclose that the image reference is being transmitted to an external service. Under the markdown-file criteria, descriptions should warn about behaviors that may affect user data or privacy.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.