Fal.ai API
Analysis
This is a coherent fal.ai API client that needs a fal.ai key and sends user-provided prompts or media URLs to fal.ai, which matches its stated purpose.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
endpoint = self.MODELS.get(model, model)
url = f"{self.QUEUE_URL}/{endpoint}"
return self._request("POST", url, payload)The client can submit payloads to listed or caller-supplied fal.ai endpoints, matching the documented broad fal.ai model support.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
api_key = os.environ.get("FAL_KEY") or self._get_config("key") ... "Authorization": f"Key {self.api_key}"The skill reads a fal.ai API key and uses it as the Authorization header for fal.ai requests.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
payload = {"audio_url": audio_url, **kwargs}
return self.submit(model, payload)Transcription sends the supplied audio URL to fal.ai, and the generation functions similarly send prompts and payloads to fal.ai's queue API.