Recraft AI

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 10:05 AM UTC
• Version: 1.0.0

Overview

This Recraft skill is a coherent image-generation and image-editing wrapper for the Recraft API, with some credential and privacy cautions users should understand.

Install only if you are comfortable sending prompts and selected images to Recraft's external API. Use RECRAFT_API_TOKEN or OpenClaw secret configuration instead of passing --api-token on the command line, avoid submitting sensitive images unless Recraft's terms are acceptable, and be aware that user-info prints account email and credit data when explicitly run.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/recraft.py:2
• Finding: Unbounded Runtime Dependency Resolution<![CDATA[ ## Vulnerability Details **File Location**: `scripts/recraft.py`, lines 2–6 **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium ### Complete Code Snippet ```python # /// script # requires-python = ">=3.10" # dependencies = [ # "requests>=2.31.0", # ] ``` ### Technical Analysis The script declares `requests` using only a minimum version constraint. There is no exact version, lockfile, or package-integrity hash in the reviewed project. Consequently, `uv run` may resolve and install a future package release that was not included in this audit. This creates a mutable supply-chain boundary: the effective code executed by the Skill can change even when the Skill itself remains unchanged. Python package installation and import mechanisms can execute package-controlled code in the context of the current user. The dependency is retrieved from the normal package ecosystem rather than an obviously malicious source, and no dependency confusion or typosquatting was observed. Nevertheless, unrestricted future dependency resolution introduces avoidable risk. ### Attack Path 1. An attacker compromises an allowed future release of the `requests` package or its distribution channel. 2. A user invokes one of the documented `uv run` commands. 3. `uv` resolves the compromised release because it satisfies `requests>=2.31.0`. 4. The package is installed and imported by `scripts/recraft.py`. 5. Package-controlled code executes with the privileges and environment of the user running the Skill. ### Impact Assessment Successful exploitation could provide code execution under the Agent user's account. The compromised dependency could access: - The `RECRAFT_API_TOKEN` environment variable. - Images and other files readable by the running user. - Prompts and image data processed by the Skill. - Network resources accessible from the host. - Files and directories writable by the running user. This does not directly grant administrator privil ...[truncated 72 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `requests` to an audited exact version rather than using a lower-bound-only constraint. 2. Commit and enforce a lockfile that records the complete dependency graph. 3. Require cryptographic hashes for downloaded packages where the tooling supports them. 4. Use a trusted, explicitly configured package index. 5. Perform automated dependency vulnerability and integrity scanning. 6. Review and deliberately update pinned dependencies instead of resolving unrestricted future versions during execution. For example: ```python # dependencies = [ # "requests==<audited-version>", # ] ``` The exact version should be selected based on current security advisories and validated compatibility. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/recraft.py:261
• Finding: API Token Exposure Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/recraft.py`, lines 261–265 and 348–355 **Vulnerability Type**: Sensitive credential accepted through process arguments **Risk Level**: Medium ### Complete Code Snippet ```python parser.add_argument( "--api-token", "-k", help="Recraft API token (overrides RECRAFT_API_TOKEN env var)", ) ``` ```python # Get API token token = get_api_token(args.api_token) if not token: print("Error: No API token provided.", file=sys.stderr) print("Please either:", file=sys.stderr) print(" 1. Provide --api-token argument", file=sys.stderr) print(" 2. Set RECRAFT_API_TOKEN environment variable", file=sys.stderr) sys.exit(1) ``` The command-line value is selected by the following helper at lines 57–60: ```python def get_api_token(provided_token: str | None) -> str | None: if provided_token: return provided_token return os.environ.get("RECRAFT_API_TOKEN") ``` ### Technical Analysis The Skill permits the Recraft bearer token to be supplied through `--api-token` or `-k`. Command-line arguments are commonly exposed through: - Shell history files. - Process inspection interfaces and process-monitoring tools. - Audit logs and endpoint telemetry. - Command logging in orchestration or Agent infrastructure. - Diagnostic output that records complete command invocations. The token is not hardcoded or deliberately printed by the script, and HTTPS is used for transmission to the declared Recraft API. The vulnerability is specifically the additional command-line credential channel. This channel is unnecessary because the Skill already supports `RECRAFT_API_TOKEN`. ### Attack Path 1. A user follows the script's error guidance and invokes it with `--api-token <secret>`. 2. The command is stored in shell history, Agent telemetry, an audit log, or a process listing. 3. A local user or operator with access to that data retrieves the token. 4. The attacker submits authenticated reque ...[truncated 793 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `--api-token` and `-k` command-line options. 2. Load the token only from `RECRAFT_API_TOKEN` or a protected secret-management mechanism. 3. If interactive entry is required, use a non-echoing prompt such as `getpass.getpass()` and avoid persisting the result. 4. Ensure configuration files containing credentials have restrictive filesystem permissions. 5. Redact credentials from process telemetry, audit records, exception reports, and application logs. 6. Update error messages and documentation so they do not recommend passing credentials on the command line. 7. Advise users who previously used `--api-token` to clear relevant history and logs and rotate the exposed token. A safer retrieval flow would reject command-line credentials and require the environment variable or an approved secret store. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill invokes a Python script that uses environment secrets, writes files, and makes outbound API calls, but the manifest does not declare an explicit tool scope such as permissions or allowed-tools. That weakens user and platform visibility into what the skill can access and do, increasing the chance of unintended secret use, silent network egress, or file writes beyond user expectations.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documented commands send user prompts and, for several operations, local input images to the external Recraft service, but the skill does not clearly warn users about that data transfer. This can cause inadvertent disclosure of sensitive images, proprietary artwork, or confidential prompt content because users may assume processing is local.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The advertised usage includes a `user-info` command that retrieves account metadata, but the skill description says it is for image generation and editing. This scope mismatch can cause unintended disclosure of personal/account data to users or higher-level agents that would reasonably expect only image-processing behavior.

External Transmission

Medium

• Category: Data Exfiltration

Content

response = requests.post(url, headers=headers, files=files, data=data)
    else:
        headers["Content-Type"] = "application/json"
        response = requests.post(url, headers=headers, json=json_data)

    if not response.ok:
        print(f"Error: API request failed with status {response.status_code}", file=sys.stderr)

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: These commands open a local image file and send it to the external Recraft API, but the skill description does not clearly disclose that user-provided files are transmitted off-system. In an agent setting, insufficient disclosure can lead to accidental exfiltration of sensitive images to a third party.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The code calls `/users/me` and prints ID, name, email, and credits, which exceeds the declared image-editing scope. Even though this is not code execution, it broadens the data-access surface and may expose sensitive account information without users expecting that behavior from this skill.

Static analysis

No suspicious patterns detected.