falimagegen

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent instruction-only fal.ai image generation helper; it may use a fal API key and send prompts or images to fal.ai, but the artifacts show no hidden code, persistence, or unrelated behavior.

This skill appears safe to install as an instruction-only helper if you intend to use fal.ai. Before running requests, confirm the model ID, review prompts/images for sensitive content, and use an environment-stored fal API key rather than hardcoding or pasting secrets.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Using the skill can submit jobs to fal.ai, which may consume API quota, generate content, or create provider-side records.

Why it was flagged

The skill authorizes the agent to make fal API calls and parse responses; this is central to the image-generation purpose but is still an external action the user should expect.

Skill content
Execute the request and return image URL(s) from the response.
Recommendation

Use it when you intend to call fal.ai, and confirm the target model and inputs before submitting requests.

What this means

The agent may use your fal account credential to submit model requests.

Why it was flagged

The examples rely on a fal API key from the environment. This is expected for fal API access and the skill also says not to hardcode API keys.

Skill content
fal.config({ credentials: process.env.FAL_KEY });
Recommendation

Provide a scoped fal key if available, avoid pasting secrets into prompts, and revoke or rotate the key if it is exposed.

What this means

Prompts, image URLs, and uploaded images may be sent to fal.ai and handled under that provider's policies.

Why it was flagged

For image-to-image workflows, the skill may upload user-provided image data to fal storage; this is purpose-aligned but crosses a provider data boundary.

Skill content
const imageUrl = await fal.storage.upload(file);
Recommendation

Only use images and prompts you are comfortable sending to fal.ai, and check fal's documentation for storage, retention, and access controls if the content is sensitive.