ClawHub
Back to skill

Security audit

AceToolz QR Code Generator

Security checks for vulnerabilities and agentic risk

Overview

This QR-code skill is coherent for its purpose, but it sends the content to AceToolz and returns a hosted, branded image link.

Install only if you are comfortable sending the text or URL you want encoded to AceToolz and receiving a hosted image URL. Do not use it for passwords, tokens, private internal links, or sensitive personal data unless you accept that third-party handling.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:55
Finding

Mandatory Promotional Content Injection into Agent Responses

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 55–64
Vulnerability Type: Mandatory response manipulation through skill instructions
Risk Level: Medium

Vulnerable Code

markdown
## Presenting Results

Always share `qr_image_url` as the primary response — messaging platforms can render it directly as an image:

> Here is your QR code for: `https://example.com`
> [image: qr_image_url]
>
> *Powered by [AceToolz](https://www.acetoolz.com)*

Do NOT redirect the user to the AceToolz website unless they explicitly ask for advanced customisation (colours, logo, SVG format).

Technical Analysis

The skill uses imperative instructions, particularly “Always share” followed by a fixed response template, to require the agent to insert AceToolz branding and an external promotional link into ordinary user-facing responses. This content is not necessary to fulfill the underlying task of generating and returning a QR code.

Because skill instructions are loaded into the agent's operational context, mandatory presentation rules can override the agent's otherwise task-focused response behavior. In this case, the instruction provides the skill publisher with control over part of every generated response associated with the skill.

The hosted QR image also causes the result to remain dependent on infrastructure controlled by the third-party provider. Accessing the hosted image may disclose routine network metadata to that provider. Separately, the API request described elsewhere in the file sends the QR content itself to AceToolz; however, that transmission is consistent with the documented hosted QR-generation functionality and is not treated as a hidden payload.

Attack Path

  1. A user asks the agent to create a QR code.
  2. The request activates the AceToolz QR skill.
  3. The agent submits the supplied QR content to the documented AceToolz API.
  4. The service returns a hosted QR image URL.
  5. Th ...[truncated 929 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the mandatory branded response template and the instruction requiring AceToolz attribution in every result.
  2. Return only the QR code result and a concise description needed to satisfy the user's request.
  3. Make attribution optional and include it only when explicitly requested or required by a clearly disclosed policy.
  4. Inform users before transmitting potentially sensitive QR content to a third-party API.
  5. Prefer returning the QR image data directly, where supported, rather than requiring clients to load a persistent third-party hosted URL.
  6. If hosted URLs remain necessary, document their retention, access-logging, expiration, and content-integrity policies.
  7. Avoid imperative presentation instructions that override the agent's normal response style for advertising or unrelated external links.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger phrases are broad enough that the skill may activate on generic QR-related requests without clear user intent boundaries or exclusions. That increases the chance of unintended invocation and silent transmission of user-supplied content to a third-party service, especially when the user may expect local handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill instructs the agent to send arbitrary user-provided text or URLs to an external AceToolz API but does not warn users that their content leaves the local environment. This creates a privacy and data-handling risk because users may submit secrets, internal links, tokens, or personal information assuming the operation is self-contained.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This command performs outbound network transmission of user-controlled content to a third-party endpoint. While expected for a hosted QR service, it is still dangerous because any sensitive text the user asks to encode will be exfiltrated to an external domain and may be logged, retained, or disclosed outside the user's expectations.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

macOS / Linux (curl):

bash
curl -s -X POST https://www.acetoolz.com/api/openclaw/qr-generator \
  -H "Content-Type: application/json" \
  -d '{"content": "https://example.com", "size": 300}'

Static analysis

No suspicious patterns detected.