ClawHub
Back to skill

Security audit

Krea.ai API

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Krea.ai image-generation skill, with credential-handling hygiene issues users should manage carefully.

Install only if you are comfortable giving the skill a Krea.ai API key. Prefer the chmod 600 credential file over passing --secret on the command line, avoid committing or backing up that file unintentionally, and rotate the Krea key if you ever used it in shell commands, logs, or shared terminals.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
krea_api.py:279
Finding
API Secret Exposed Through Command-Line Arguments## Vulnerability Details **File Location**: `krea_api.py:279-280`; supporting documentation at `README.md:23-25` and `SKILL.md:34-38` **Vulnerability Type**: Sensitive credential exposure through process arguments and shell history **Risk Level**: Medium ### Vulnerable Code ```python parser.add_argument("--key-id", help="API key ID") parser.add_argument("--secret", help="API secret") ``` The README explicitly instructs users to supply credentials this way: ```bash python3 krea_api.py --prompt "..." --key-id YOUR_KEY_ID --secret YOUR_SECRET ``` ### Technical Analysis The application accepts the Krea API secret as a literal command-line argument. Command-line arguments are not a secure secret-transport mechanism because they may be: - Stored in interactive shell history. - Captured by command auditing, telemetry, or process-monitoring systems. - Visible through operating-system process inspection while the command is running. - Included in terminal transcripts, support bundles, or automation logs. The secret is subsequently combined with the key ID and used as a Bearer credential. Although transmitting that credential to the fixed HTTPS endpoint `https://api.krea.ai` is necessary for the declared functionality, accepting it directly on the command line unnecessarily expands its exposure surface. The project also supports a dedicated credential file at `~/.openclaw/credentials/krea.json` and documents mode `600`. That file-based mechanism is more appropriate and means command-line secret handling is not required for normal operation. ### Attack Path 1. A user follows the documented example and executes the program with `--secret SECRET_VALUE`. 2. The complete command is retained in shell history, captured in logs, or temporarily exposed through local process-inspection facilities. 3. A local user, administrator, monitoring component, or party with access to collected logs retrieves the command-line value. ...[truncated 855 chars]
Remediation
## Remediation Suggestions 1. Remove the `--secret` option and use the existing permission-restricted credential file as the primary authentication mechanism. 2. If interactive entry is required, read the secret with Python's `getpass.getpass()` so it is neither echoed nor included in process arguments. 3. For automation, integrate with a secret manager or accept the name of a protected environment variable rather than accepting the secret value as an argument. 4. Update `README.md` and `SKILL.md` to remove examples or recommendations that place literal credentials on the command line. 5. Retain the dedicated `~/.openclaw/credentials/krea.json` path, but validate before use that it is a regular file, is owned by the expected user, and is not accessible by group or other users. 6. Advise users who previously used `--secret` to clear affected shell history and logs where feasible, then rotate the exposed Krea API credential.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Session Persistence

Medium
Category
Rogue Agent
Content
## Configure Credentials

Create the credentials file:
```bash
mkdir -p ~/.openclaw/credentials
echo '{"apiKey": "YOUR_KEY_ID:YOUR_SECRET"}' > ~/.openclaw/credentials/krea.json
Confidence
79% confidence
Finding
The README instructs users to store persistent API credentials in a local file under the home directory. While this is common practice, it creates a lasting secret at rest that may be exposed through backups, accidental commits, endpoint compromise, or weak workstation hygiene if not paired with stronger guidance on secure storage.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
```bash
mkdir -p ~/.openclaw/credentials
echo '{"apiKey": "YOUR_KEY_ID:YOUR_SECRET"}' > ~/.openclaw/credentials/krea.json
chmod 600 ~/.openclaw/credentials/krea.json
```

Or pass directly via CLI:
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
```bash
mkdir -p ~/.openclaw/credentials
echo '{"apiKey": "YOUR_KEY_ID:YOUR_SECRET"}' > ~/.openclaw/credentials/krea.json
chmod 600 ~/.openclaw/credentials/krea.json
```

Or pass directly via CLI:
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The README explicitly instructs users to provide the API key ID and secret on the command line. Command-line arguments are commonly exposed through shell history, process listings, audit logs, and CI/job output, which can leak long-lived credentials to other local users or logging systems.

Session Persistence

Medium
Category
Rogue Agent
Content
## Setup

1. Get your Krea.ai API credentials from https://docs.krea.ai/developers/api-keys-and-billing
2. Create the credentials file:
```bash
mkdir -p ~/.openclaw/credentials
```
Confidence
85% confidence
Finding
The skill instructs users to persist a long-lived API secret in a predictable plaintext file under the home directory. Even with restrictive permissions, this creates durable credential material that can be harvested by other local processes, backups, misconfigurations, or future compromise of the account.

File System Enumeration

Medium
Category
Data Exfiltration
Content
1. Check credentials file exists:
```bash
ls -la ~/.openclaw/credentials/krea.json
# Should show: -rw-------
```
Confidence
60% confidence
Finding
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
"  1. Arguments: --key-id ID --secret SECRET\n"
                "  2. File: ~/.openclaw/credentials/krea.json\n"
                "     Format: {\"apiKey\": \"KEY_ID:SECRET\"}\n"
                "     Permissions: chmod 600 ~/.openclaw/credentials/krea.json"
            )
        
        self.token = f"{key_id}:{secret}"
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Context-Inappropriate Capability

Low
Confidence
84% confidence
Finding
With no manifest available, the code documentation presents this as an image generation API client. Opening a local web browser to a usage dashboard is an additional host-side capability beyond making Krea API calls, and it is not necessary to generate images or poll job status.

Static analysis

No suspicious patterns detected.