Krea.ai API

Generate images via Krea.ai API (Flux, Imagen, Ideogram, Seedream, etc.)

Security Scan

The skill's code and instructions match its stated purpose (calling Krea.ai endpoints using a local credential file); no unexpected permissions, installs, or network endpoints were found, though the registry metadata omits the declared file-based credential.

Purpose & Capability

Name/description (Krea.ai image generation) align with the included code and SKILL.md: the package makes HTTPS calls to api.krea.ai endpoints, supports listed models, and exposes CLI and module usage that a Krea client would need.

Instruction Scope

SKILL.md and the code limit actions to reading a single credentials file (~/.openclaw/credentials/krea.json), performing HTTP(S) calls to api.krea.ai, listing/polling jobs, and optionally opening a browser via webbrowser.open(). There are no instructions to read unrelated files, call arbitrary subprocesses, or post data to external endpoints other than api.krea.ai (and the documented dashboard URL).

Install Mechanism

No install spec; the skill is distributed as code only and uses only Python stdlib (urllib, webbrowser). This is the lowest-risk install model given the included files.

Credentials

The skill requires API credentials stored in ~/.openclaw/credentials/krea.json (documented in SKILL.md and used by the code). This is proportionate to its purpose. However, the registry metadata summary provided earlier listed no primary credential/environment requirements — that metadata omission is inconsistent with the SKILL.md and code and should be reconciled before trusting automated tooling that relies on registry metadata.

Persistence & Privilege

The skill does not request persistent platform privileges (always is false), does not modify other skills or agent-wide settings, and operates only when invoked. It does read a credential file in the user's home directory, which is expected for API usage.

Assessment

This skill appears to be what it says: a Krea.ai client that reads a local credentials file and talks only to api.krea.ai. Before installing or running it: 1) verify the credential file path (~/.openclaw/credentials/krea.json) and ensure you only store a Krea API key there with strict permissions (chmod 600); 2) confirm the skill source (the package lists an unknown source/homepage) — prefer installing code from an official or trusted repository; 3) inspect krea_api.py (it is included) to ensure no changes were made from the reviewed copy; and 4) if you want stronger assurance, run the script in a sandboxed environment or review network traffic to confirm it only contacts api.krea.ai. Also note the registry metadata omitted the declared file-based credential — treat automated metadata as incomplete until reconciled.

Krea.ai Image Generation Skill

Generate images using Krea.ai's API with support for multiple models including Flux, Imagen 4, Ideogram 3.0, and more.

Features

• ✅ Async job-based generation (POST → poll → result)
• ✅ Support for multiple image models
• ✅ Configurable parameters (width, height, steps, guidance, seed)
• ✅ Stdlib-only dependencies (no requests required)
• ✅ Secure credential handling with file permissions

Security

This skill prioritizes security:

• No webhook support - Removed to prevent SSRF risks
• Stdlib dependencies - Minimal attack surface (uses urllib only)
• File-based credentials - Primary credential source with secure permissions
• Input validation - All parameters validated before API calls

Credential Sources (in order of precedence)

1. CLI arguments: --key-id and --secret (for one-off use)
2. File: ~/.openclaw/credentials/krea.json

Note on Subprocess

The --usage flag uses webbrowser.open() (stdlib) to open the usage dashboard in a browser. No subprocess calls.

Setup

1. Get your Krea.ai API credentials from https://docs.krea.ai/developers/api-keys-and-billing
2. Create the credentials file:

mkdir -p ~/.openclaw/credentials

3. Add your credentials:

echo '{"apiKey": "YOUR_KEY_ID:YOUR_SECRET"}' > ~/.openclaw/credentials/krea.json

4. Set secure permissions:

chmod 600 ~/.openclaw/credentials/krea.json

Usage

Command Line

# Generate an image
python3 krea_api.py --prompt "A sunset over the ocean"

# With specific model
python3 krea_api.py --prompt "Cyberpunk city" --model imagen-4

# Custom size
python3 krea_api.py --prompt "Portrait" --width 1024 --height 1280

# List available models
python3 krea_api.py --list-models

# Check recent jobs
python3 krea_api.py --jobs 10

Python Script

from krea_api import KreaAPI

api = KreaAPI()  # Reads from ~/.openclaw/credentials/krea.json

# Generate and wait
urls = api.generate_and_wait(
    prompt="A serene Japanese garden",
    model="flux",
    width=1024,
    height=1024
)
print(urls)

Parameters

Parameter	Type	Default	Description
prompt	str	required	Image description (max 1800 chars)
model	str	"flux"	Model name from table below
width	int	1024	Image width (512-2368)
height	int	1024	Image height (512-2368)
steps	int	25	Generation steps (1-100)
guidance_scale	float	3.0	Guidance scale (0-24)
seed	str	None	Random seed for reproducibility

Available Models

Model	Best For
flux	General purpose, high quality
imagen-4	Latest Google model
ideogram-3.0	Text in images
seedream-4	Fast generations
nano-banana	Quick previews

Run python3 krea_api.py --list-models for full list.

Check Usage

Krea.ai doesn't provide a public usage API. Check your usage at:

https://www.krea.ai/settings/usage-statistics

Or list recent jobs:

python3 krea_api.py --jobs 10

File Locations

Purpose	Path
Credentials	~/.openclaw/credentials/krea.json
Script	{skill}/krea_api.py
Skill docs	{skill}/SKILL.md

Troubleshooting

"API credentials required"

1. Check credentials file exists:

ls -la ~/.openclaw/credentials/krea.json
# Should show: -rw-------

2. Verify format (must have colon):

{"apiKey": "KEY_ID:SECRET"}

⚠️ Security: Do NOT use cat to view the credentials file — it contains secrets.

Model not found

Run python3 krea_api.py --list-models to see available models.

Credits

Thanks to Claude Opus 4.5 for researching the correct API structure. The docs incorrectly suggest /v1/images/flux but the working endpoint is /generate/image/bfl/flux-1-dev.