ClawHub
Back to skill

Security audit

Phy Fal Model Selector

Security checks across malware telemetry and agentic risk

Overview

This is a read-only guide for choosing fal.ai media models, with no executable code or hidden install behavior found.

Safe to install as an informational fal.ai model guide. Before using its snippets with real projects, verify current fal.ai pricing and model IDs, and avoid sending private images, videos, or URLs to fal.ai unless you intend to use that third-party service.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger description is unusually broad and includes generic phrases like 'generate video', 'edit image', 'remove background', and 'which model should I use', which can cause the skill to activate for many ordinary user requests outside a clear fal.ai selection context. This creates an overreach risk where the skill may intercept unrelated conversations and steer users toward external model usage or recommendations they did not explicitly request.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The examples instruct sending image URLs to fal.ai endpoints but do not disclose that user-provided media may be transmitted to a third-party service for processing. In a skill focused on model selection and example usage, this omission can lead users or downstream agents to share sensitive images without informed consent, creating privacy and data-handling risk.

VirusTotal

No VirusTotal findings

View on VirusTotal