ClawHub
Back to skill

Security audit

Fal Ai

Security checks across malware telemetry and agentic risk

Overview

This is a coherent fal.ai media-generation helper, but users should know it sends selected prompts and media to fal.ai and stores queue state locally.

Install only if you are comfortable using a fal.ai API key and sending chosen prompts, images, videos, URLs, and possible audio to fal.ai for processing. Prefer FAL_KEY or a dedicated local config over committing secrets to TOOLS.md, avoid submitting sensitive or regulated media, keep FAL_PENDING_FILE in the OpenClaw workspace, and clear fal-pending.json after sensitive jobs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (7)

Tainted flow: 'PENDING_FILE' from os.environ.get (line 61, credential/environment) → pathlib.Path.write_text (file write)

Medium
Category
Data Flow
Content
def save_pending(data):
    """Save pending requests to file"""
    PENDING_FILE.parent.mkdir(parents=True, exist_ok=True)
    PENDING_FILE.write_text(json.dumps(data, indent=2))

def submit(model_id: str, input_data: dict, skip_validation: bool = False) -> dict:
    """Submit a request to the queue with validation"""
Confidence
90% confidence
Finding
PENDING_FILE.write_text(json.dumps(data, indent=2))

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill documents and enables use of environment variables, local file reads/writes, shell commands, and outbound network access, but does not declare permissions. That mismatch weakens reviewability and least-privilege enforcement, making it easier for a caller or future code changes to use sensitive capabilities without clear scrutiny.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The client searches multiple local sources, including TOOLS.md and a general OpenClaw config file, for API credentials. Reading secrets from broad, unrelated local files expands the skill's access to local sensitive data beyond the narrowly expected API interaction and increases the chance of unintended credential exposure or cross-skill secret harvesting.

Vague Triggers

Medium
Confidence
83% confidence
Finding
The activation description includes broad phrases like 'create visuals' and 'anything involving fal.ai,' which can cause the skill to trigger for common user requests outside a narrowly intended scope. Over-broad routing increases the chance that prompts, files, or credentials are sent to this networked skill unexpectedly, expanding attack surface and causing unintended external data handling.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The setup instructions tell users to place an API key in TOOLS.md without a clear warning that this is a sensitive secret that must not be exposed, logged, or committed. In a skill that also reads files and uses shell/network operations, insufficient credential-handling guidance increases the risk of accidental disclosure through source control, prompts, logs, or other tooling.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
These helpers read arbitrary local image/video files, convert the full contents to data URIs, and are clearly intended for inclusion in API requests to fal.ai. Without an explicit user-facing disclosure or guardrail, the skill can unintentionally exfiltrate sensitive local media content to a third-party service.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The submit flow sends user inputs to an external service and stores full request inputs and later results in a local pending file. Because prompts, media URLs, data URIs, and generated outputs may contain sensitive information, this creates both external data-sharing and local data-retention risk without visible minimization or consent controls.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.