Fal.ai API

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent fal.ai API client that needs a fal.ai key and sends user-provided prompts or media URLs to fal.ai, which matches its stated purpose.

Before installing, be comfortable giving this skill a fal.ai API key and sending your prompts or media URLs to fal.ai. Use a dedicated key if possible, monitor credit usage, and avoid submitting sensitive content unless fal.ai's policies fit your needs.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

Using the skill with your FAL_KEY lets it submit jobs under your fal.ai account, which may use account quota or paid credits.

Why it was flagged

The skill reads a fal.ai API key and uses it as the Authorization header for fal.ai requests.

Skill content

api_key = os.environ.get("FAL_KEY") or self._get_config("key") ... "Authorization": f"Key {self.api_key}"

Recommendation

Use a dedicated or revocable fal.ai key with appropriate limits, and monitor fal.ai usage if cost or quota matters.

Note

ASI02: Tool Misuse and Exploitation

What this means

A user or agent can invoke many fal.ai models, potentially generating content or spending credits beyond the small example list.

Why it was flagged

The client can submit payloads to listed or caller-supplied fal.ai endpoints, matching the documented broad fal.ai model support.

Skill content

endpoint = self.MODELS.get(model, model)
url = f"{self.QUEUE_URL}/{endpoint}"
return self._request("POST", url, payload)

Recommendation

Review the selected model and prompt before use; if needed, restrict usage to approved model names or workflows.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Prompts and media URLs you provide are shared with fal.ai for processing; sensitive content may be handled by that provider.

Why it was flagged

Transcription sends the supplied audio URL to fal.ai, and the generation functions similarly send prompts and payloads to fal.ai's queue API.

Skill content

payload = {"audio_url": audio_url, **kwargs}
return self.submit(model, payload)

Recommendation

Only submit private prompts, image URLs, or audio URLs if fal.ai's data-handling terms and your account settings are acceptable.