ClawHub
Back to skill

Security audit

Phy Ai Image

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward fal.ai image-generation workflow that discloses its external API use and local saves, with some privacy and packaging caveats users should understand.

Install only if you are comfortable using fal.ai for generation. Use a dedicated FAL_API_KEY, do not submit confidential prompts or private images without considering third-party processing, and expect generated images to be saved locally under ~/Pictures/ai-image. The referenced prompt-library files are not included in this package, so some inspiration/template features may not work unless those files exist.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger text explicitly says it activates on 'any image creation request,' which is overly broad and can cause the skill to intercept general user intent without clear scoping or consent. In an agent setting, broad triggers increase the chance of unintended execution of workflows that call external services or save files locally.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The documented workflow sends prompts to fal.ai and downloads generated outputs to a local path, but it does not require a user-facing notice that data leaves the local environment or that files will be written to disk. This creates privacy and transparency risks, especially if prompts contain sensitive information or users are unaware of persistent local storage.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The reference-image flow instructs the agent to upload local images or pass image URLs to fal.ai without warning that user-provided images may be transmitted to a third-party service. Because images often contain personal, proprietary, or embedded metadata, this omission materially increases privacy exposure.

VirusTotal

No VirusTotal findings

View on VirusTotal

Static analysis

No suspicious patterns detected.