ClawHub
Back to skill

Security audit

Fal.ai API

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward fal.ai media-generation client, with expected API-key and network use for generating or transcribing media.

Install only if you are comfortable sending prompts, media URLs, audio content, and your fal.ai API key to fal.ai for processing. Avoid private recordings, secrets, regulated data, or signed internal URLs, and prefer a scoped or revocable API key where possible.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README instructs users to configure an API key and use a remote media-generation service, but it does not clearly warn that prompts, images, audio, or other submitted content will be transmitted to a third-party provider. This can lead users to unintentionally send sensitive or regulated data off-host, creating privacy, confidentiality, and compliance risks in environments where users may assume local-only processing.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill explicitly requires an environment secret (FAL_KEY) and documents networked API usage plus CLI execution, but it does not declare any tool/permission scope such as allowed-tools or permissions. That omission weakens sandboxing and reviewability because consumers cannot easily see or constrain that the skill needs env, network, and shell-capable execution before use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill encourages users to submit prompts and potentially media/audio to fal.ai, but it does not prominently warn that this content is sent to a third-party external API. This can lead to unintentional disclosure of sensitive prompts, images, audio, or transcripts, especially in environments where users may assume local-only processing.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes a fal.ai media generation skill, where network calls to the fal.ai API are expected. However, this code also imports subprocess and runs a local clawdbot config get command to obtain credentials, adding host command-execution capability unrelated to directly generating images, video, or audio.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · fal_api.py (reported line 79)May include surrounding context.

python
"""Get config from clawdbot config if available."""
        try:
            import subprocess
            result = subprocess.run(
                ["clawdbot", "config", "get", f"skill.fal_api.{key}"],
                capture_output=True, text=True
            )

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The transcription method forwards a user-supplied audio URL to fal.ai, causing audio content and potentially sensitive metadata to be transmitted to a third-party service. In a skill context, this is dangerous when users may not realize private recordings, signed URLs, or internal resource locations are being sent off-platform.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.