Recraft AI
PassAudited by ClawScan on May 1, 2026.
Overview
The skill appears aligned with its stated Recraft image-generation purpose, but users should understand it uses a Recraft API token, sends selected images/prompts to Recraft, and installs a Python dependency through uv.
Install this if you are comfortable giving it a Recraft API token, sending selected images/prompts to Recraft for processing, and allowing uv to resolve the Python requests dependency. Use non-sensitive images unless you trust Recraft's handling of them, and choose output file paths deliberately.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Anyone installing the skill should treat the token like an account credential and expect the skill to make authenticated Recraft API requests.
The skill requires a Recraft API token, which is expected for Recraft API access but gives the script authenticated access to the user's Recraft account.
`RECRAFT_API_TOKEN` env var
Use a dedicated Recraft API token if available, keep it out of shared logs or transcripts, and revoke it if you stop using the skill.
Input images and prompts used with editing or generation commands may be transmitted to Recraft for processing.
The script sends prompts and, for editing commands, user-selected image files to Recraft's external API endpoint. This is purpose-aligned and disclosed by the skill description.
BASE_URL = "https://external.api.recraft.ai/v1"
Avoid sending private or sensitive images unless you are comfortable with Recraft processing them under its service terms.
This is a common and purpose-aligned Python dependency pattern, but it relies on normal package-index trust and version resolution.
The uv script declares an unpinned lower-bound dependency on requests, so dependency resolution may fetch a current compatible package rather than a locked version.
dependencies = [ # "requests>=2.31.0", # ]
Install from trusted environments and consider pinning or reviewing resolved dependencies if you need strict supply-chain control.