ClawHub
Back to skill

Security audit

Local QR Code Generator

Security checks for vulnerabilities and agentic risk

Overview

This skill locally generates QR codes and does not show hidden network, credential, persistence, or destructive behavior.

Install in a dedicated virtual environment and consider pinning dependency versions if reproducibility matters. The skill writes a PNG only to the output path you provide and otherwise appears narrowly scoped to local QR code generation.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:18
Finding

Unpinned Third-Party Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18–22
Vulnerability Type: Supply-chain risk from unpinned dependencies
Risk Level: Medium

Vulnerable Code Snippet:

markdown
## Dependencies

Requires `qrcode` and `Pillow` Python packages:
```bash
pip install qrcode pillow
text

### Technical Analysis

The documented installation command retrieves the latest available versions of `qrcode` and `Pillow` from the package index without version constraints, integrity hashes, or a lockfile. Consequently, installations are not reproducible and the dependency code installed by users can differ from the code originally reviewed.

This does not establish that either named package is currently malicious. However, if a package release or its distribution channel is compromised, following the documented command could install attacker-controlled code. Python packages may execute code during installation, and imported package modules execute initialization code when either QR-generation script starts.

### Attack Path

1. An attacker compromises a dependency publisher account, package release, or relevant distribution channel.
2. The attacker publishes a malicious version under one of the dependency names used by the project.
3. A user follows the documented `pip install qrcode pillow` instruction.
4. Because no versions or hashes are specified, the package installer selects the malicious release.
5. Attacker-controlled code executes during installation or when `qrcode` or Pillow components are imported by the scripts.

### Impact Assessment

Malicious dependency code would generally execute with the privileges of the user running `pip` or invoking the scripts. Depending on those privileges, it could access user-readable files and credentials, alter files, execute processes, communicate over the network, or compromise the active Python environment. If installation is performed with administrative privile
...[truncated 51 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin each dependency to a reviewed, exact version in a requirements or lock file.
  • Record and enforce cryptographic hashes, such as with pip install --require-hashes -r requirements.txt.
  • Review dependency updates before changing pinned versions.
  • Use automated dependency and vulnerability scanning in continuous integration.
  • Recommend installation in a dedicated virtual environment under a non-privileged account.
  • Prefer a trusted, explicitly configured package index and avoid running package installation with administrative privileges.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.