Recraft AI

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 10:05 AM UTC
• Version: 1.0.0

Overview

This Recraft skill is a coherent image-generation and image-editing wrapper for the Recraft API, with some credential and privacy cautions users should understand.

Install only if you are comfortable sending prompts and selected images to Recraft's external API. Use RECRAFT_API_TOKEN or OpenClaw secret configuration instead of passing --api-token on the command line, avoid submitting sensitive images unless Recraft's terms are acceptable, and be aware that user-info prints account email and credit data when explicitly run.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/recraft.py:2

Finding

Unbounded Runtime Dependency Resolution

Content

View full analysis

=3.10" # dependencies = [ # "requests>=2.31.0", # ] ``` ### Technical Analysis The script declares `requests` using only a minimum version constraint. There is no exact version, lockfile, or package-integrity hash in the reviewed project. Consequently, `uv run` may resolve and install a future package release that was not included in this audit. This creates a mutable supply-chain boundary: the effective code executed by the Skill can change even when the Skill itself remains unchanged. Python package installation and import mechanisms can execute package-controlled code in the context of the current user. The dependency is retrieved from the normal package ecosystem rather than an obviously malicious source, and no dependency confusion or typosquatting was observed. Nevertheless, unrestricted future dependency resolution introduces avoidable risk. ### Attack Path 1. An attacker compromises an allowed future release of the `requests` package or its distribution channel. 2. A user invokes one of the documented `uv run` commands. 3. `uv` resolves the compromised release because it satisfies `requests>=2.31.0`. 4. The package is installed and imported by `scripts/recraft.py`. 5. Package-controlled code executes with the privileges and environment of the user running the Skill. ### Impact Assessment Successful exploitation could provide code execution under the Agent user's account. The compromised dependency could access: - The `RECRAFT_API_TOKEN` environment variable. - Images and other files readable by the running user. - Prompts and image data processed by the Skill. - Network resources accessible from the host. - Files and directories writable by the running user. This does not directly grant administrator privil ...[truncated 72 chars]

Remediation

View remediation

", # ] ``` The exact version should be selected based on current security advisories and validated compatibility. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/recraft.py:261

Finding

API Token Exposure Through Command-Line Arguments

Content

View full analysis

str | None: if provided_token: return provided_token return os.environ.get("RECRAFT_API_TOKEN") ``` ### Technical Analysis The Skill permits the Recraft bearer token to be supplied through `--api-token` or `-k`. Command-line arguments are commonly exposed through: - Shell history files. - Process inspection interfaces and process-monitoring tools. - Audit logs and endpoint telemetry. - Command logging in orchestration or Agent infrastructure. - Diagnostic output that records complete command invocations. The token is not hardcoded or deliberately printed by the script, and HTTPS is used for transmission to the declared Recraft API. The vulnerability is specifically the additional command-line credential channel. This channel is unnecessary because the Skill already supports `RECRAFT_API_TOKEN`. ### Attack Path 1. A user follows the script's error guidance and invokes it with `--api-token `. 2. The command is stored in shell history, Agent telemetry, an audit log, or a process listing. 3. A local user or operator with access to that data retrieves the token. 4. The attacker submits authenticated reque ...[truncated 793 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill invokes a Python script that uses environment secrets, writes files, and makes outbound API calls, but the manifest does not declare an explicit tool scope such as permissions or allowed-tools. That weakens user and platform visibility into what the skill can access and do, increasing the chance of unintended secret use, silent network egress, or file writes beyond user expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented commands send user prompts and, for several operations, local input images to the external Recraft service, but the skill does not clearly warn users about that data transfer. This can cause inadvertent disclosure of sensitive images, proprietary artwork, or confidential prompt content because users may assume processing is local.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The advertised usage includes a user-info command that retrieves account metadata, but the skill description says it is for image generation and editing. This scope mismatch can cause unintended disclosure of personal/account data to users or higher-level agents that would reasonably expect only image-processing behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/recraft.py (reported line 106)May include surrounding context.

python

response = requests.post(url, headers=headers, files=files, data=data)
    else:
        headers["Content-Type"] = "application/json"
        response = requests.post(url, headers=headers, json=json_data)

    if not response.ok:
        print(f"Error: API request failed with status {response.status_code}", file=sys.stderr)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

These commands open a local image file and send it to the external Recraft API, but the skill description does not clearly disclose that user-provided files are transmitted off-system. In an agent setting, insufficient disclosure can lead to accidental exfiltration of sensitive images to a third party.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code calls /users/me and prints ID, name, email, and credits, which exceeds the declared image-editing scope. Even though this is not code execution, it broadens the data-access surface and may expose sensitive account information without users expecting that behavior from this skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.