Krea.ai API

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:08 AM UTC
• Version: 0.2.4

Overview

This is a straightforward Krea.ai image-generation skill, with credential-handling hygiene issues users should manage carefully.

Install only if you are comfortable giving the skill a Krea.ai API key. Prefer the chmod 600 credential file over passing --secret on the command line, avoid committing or backing up that file unintentionally, and rotate the Krea key if you ever used it in shell commands, logs, or shared terminals.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: krea_api.py:279

Finding

API Secret Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: krea_api.py:279-280; supporting documentation at README.md:23-25 and SKILL.md:34-38
Vulnerability Type: Sensitive credential exposure through process arguments and shell history
Risk Level: Medium

Vulnerable Code

python

parser.add_argument("--key-id", help="API key ID")
parser.add_argument("--secret", help="API secret")

The README explicitly instructs users to supply credentials this way:

bash

python3 krea_api.py --prompt "..." --key-id YOUR_KEY_ID --secret YOUR_SECRET

Technical Analysis

The application accepts the Krea API secret as a literal command-line argument. Command-line arguments are not a secure secret-transport mechanism because they may be:

• Stored in interactive shell history.
• Captured by command auditing, telemetry, or process-monitoring systems.
• Visible through operating-system process inspection while the command is running.
• Included in terminal transcripts, support bundles, or automation logs.

The secret is subsequently combined with the key ID and used as a Bearer credential. Although transmitting that credential to the fixed HTTPS endpoint https://api.krea.ai is necessary for the declared functionality, accepting it directly on the command line unnecessarily expands its exposure surface.

The project also supports a dedicated credential file at ~/.openclaw/credentials/krea.json and documents mode 600. That file-based mechanism is more appropriate and means command-line secret handling is not required for normal operation.

Attack Path

1. A user follows the documented example and executes the program with --secret SECRET_VALUE.
2. The complete command is retained in shell history, captured in logs, or temporarily exposed through local process-inspection facilities.
3. A local user, administrator, monitoring component, or party with access to collected logs retrieves the command-line value.

...[truncated 855 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the --secret option and use the existing permission-restricted credential file as the primary authentication mechanism.
2. If interactive entry is required, read the secret with Python's getpass.getpass() so it is neither echoed nor included in process arguments.
3. For automation, integrate with a secret manager or accept the name of a protected environment variable rather than accepting the secret value as an argument.
4. Update README.md and SKILL.md to remove examples or recommendations that place literal credentials on the command line.
5. Retain the dedicated ~/.openclaw/credentials/krea.json path, but validate before use that it is a regular file, is owned by the expected user, and is not accessible by group or other users.
6. Advise users who previously used --secret to clear affected shell history and logs where feasible, then rotate the exposed Krea API credential.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 79% confidence

Finding

The README instructs users to store persistent API credentials in a local file under the home directory. While this is common practice, it creates a lasting secret at rest that may be exposed through backups, accidental commits, endpoint compromise, or weak workstation hygiene if not paired with stronger guidance on secure storage.

Content

Scanner excerpt · README.md (reported line 17)May include surrounding context.

Configure Credentials

Create the credentials file:

bash

mkdir -p ~/.openclaw/credentials
echo '{"apiKey": "YOUR_KEY_ID:YOUR_SECRET"}' > ~/.openclaw/credentials/krea.json

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 21)May include surrounding context.

bash

mkdir -p ~/.openclaw/credentials
echo '{"apiKey": "YOUR_KEY_ID:YOUR_SECRET"}' > ~/.openclaw/credentials/krea.json
chmod 600 ~/.openclaw/credentials/krea.json

Or pass directly via CLI:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

bash

mkdir -p ~/.openclaw/credentials
echo '{"apiKey": "YOUR_KEY_ID:YOUR_SECRET"}' > ~/.openclaw/credentials/krea.json
chmod 600 ~/.openclaw/credentials/krea.json

Or pass directly via CLI:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README explicitly instructs users to provide the API key ID and secret on the command line. Command-line arguments are commonly exposed through shell history, process listings, audit logs, and CI/job output, which can leak long-lived credentials to other local users or logging systems.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

The skill instructs users to persist a long-lived API secret in a predictable plaintext file under the home directory. Even with restrictive permissions, this creates durable credential material that can be harvested by other local processes, backups, misconfigurations, or future compromise of the account.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

Setup

1. Get your Krea.ai API credentials from https://docs.krea.ai/developers/api-keys-and-billing
2. Create the credentials file:

bash

mkdir -p ~/.openclaw/credentials

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

1. Check credentials file exists:

bash

ls -la ~/.openclaw/credentials/krea.json
# Should show: -rw-------

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · krea_api.py (reported line 67)May include surrounding context.

python

"  1. Arguments: --key-id ID --secret SECRET\n"
                "  2. File: ~/.openclaw/credentials/krea.json\n"
                "     Format: {\"apiKey\": \"KEY_ID:SECRET\"}\n"
                "     Permissions: chmod 600 ~/.openclaw/credentials/krea.json"
            )
        
        self.token = f"{key_id}:{secret}"

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

With no manifest available, the code documentation presents this as an image generation API client. Opening a local web browser to a usage dashboard is an additional host-side capability beyond making Krea API calls, and it is not necessary to generate images or poll job status.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.