fal
v1.0.1Search, explore, and run fal.ai generative AI models (image generation, video, audio, 3D). Use when user wants to generate images, videos, or other media with AI models.
⭐ 1· 2k·5 current·6 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill is described as a fal.ai model runner and all runtime instructions call fal-related endpoints (api.fal.ai, queue.fal.run, fal.run); requesting an API key for fal.ai (FAL_KEY) is appropriate. However, the registry metadata lists no required environment variables while SKILL.md explicitly requires FAL_KEY, so the declared metadata does not fully match the runtime instructions.
Instruction Scope
SKILL.md contains concrete curl-based commands to search models, fetch schemas, submit jobs, poll status, download results, and upload files. It only references the fal domains and saves outputs to ~/.fal/sessions/${CLAUDE_SESSION_ID}. It does not instruct reading unrelated files or exfiltrating arbitrary data. Note: it references CLAUDE_SESSION_ID (a platform session variable) which is not declared in the metadata but is likely provided by the agent environment.
Install Mechanism
This is instruction-only (no install spec and no code files to execute). That minimizes on-disk installation risk.
Credentials
The skill needs one sensitive credential (FAL_KEY), which is reasonable for calling fal.ai APIs. However, the skill metadata failed to declare this required environment variable. The omission is an inconsistency that could confuse users and automated permission reviews; verify you are intentionally providing a fal.ai API key and not other platform secrets.
Persistence & Privilege
The skill does not request permanent/always-on inclusion (always: false) and does not modify other skills or global agent settings. It does write output files under the user's home (~/.fal/sessions), which is expected for this use case.
What to consider before installing
This skill appears to be a straightforward wrapper around fal.ai HTTP APIs and needs a single API key (FAL_KEY). Before installing: 1) Confirm the skill source — the registry metadata lacks a homepage and does not declare FAL_KEY even though SKILL.md requires it. Prefer official repos (e.g., fal.ai or fal-ai GitHub). 2) Only provide an API key you control; consider creating a limited-scope/test key if fal.ai supports it. 3) Be aware the skill will write generated media to ~/.fal/sessions/${CLAUDE_SESSION_ID} — check that location and remove any sensitive outputs. 4) If you’re concerned about network endpoints, verify the domains (api.fal.ai, queue.fal.run, fal.run) are legitimate before using your key. 5) If you need higher assurance, ask the publisher for a homepage and a signed/known source or inspect an actual implementation (code) rather than relying on instructions-only metadata.Like a lobster shell, security has layers — review code before you run it.
latestvk970hxwn43pjpmgsbjswtdg1es80m0kw
License
MIT-0
Free to use, modify, and redistribute. No attribution required.