Security audit

Qr Code Generator

Security checks for vulnerabilities and agentic risk

Overview

This QR code skill largely does what it claims, but it needs review because sensitive QR contents can be printed to logs and batch files can write outside the chosen output folder.

Install only in a virtual environment, avoid processing batch CSV/JSON files from untrusted sources, choose an output directory you are comfortable writing to, and treat QR codes containing WiFi passwords or personal data as sensitive. Be aware that this version may print encoded data to stderr, so avoid using it with secrets in shared terminals, CI logs, or agent logs until that behavior is fixed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/qr.py:369
Finding: Batch-Supplied Filenames Permit Path Traversal and Arbitrary File Overwrite
Content: View full analysis
Remediation: View remediation
Path: base = Path(output_dir).resolve() candidate_name = Path(supplied_name) if candidate_name.is_absolute(): raise ValueError("Absolute output paths are not allowed") candidate = (base / candidate_name).resolve() if candidate != base and base not in candidate.parents: raise ValueError("Output path escapes the configured directory") return candidate ``` Additional hardening should include: 1. Prefer accepting only a basename: ```python if Path(supplied_name).name != supplied_name: raise ValueError("Output filename must not contain directories") ``` 2. Restrict extensions to the format actually being generated. 3. Reject empty filenames and platform-specific special paths. 4. Consider refusing to overwrite existing files unless an explicit `--overwrite` option is supplied. 5. Evaluate symbolic links immediately before opening the destination, or open files using platform-specific no-follow protections where available. 6. Run the skill with the minimum filesystem permissions required. 7. Add regression tests covering `../`, absolute paths, nested traversal, symbolic links, and valid filenames. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: scripts/qr.py:662
Finding: Sensitive QR Payloads Are Disclosed Through Standard Error Logging
Content: View full analysis
100 else ''}", file=sys.stderr) elif not success: sys.exit(1) ``` ### Technical Analysis The application supports QR payloads containing sensitive information, including WiFi passwords, telephone numbers, email content, SMS messages, addresses, and contact details. After successful generation, it prints the first 100 characters of the fully formatted payload to standard error. For a WiFi QR code, the formatted payload places the password near the beginning: ```text WIFI:T:WPA;S:NetworkName;P:password;H:false;; ``` Consequently, the 100-character truncation does not reliably protect secrets. Standard error is frequently collected by terminal histories, CI/CD services, job runners, Agent execution frameworks, monitoring systems, or application wrappers. The implementation does not transmit this information over the network itself, but it unnecessarily exposes sensitive values to downstream logging infrastructure. ### Attack Path 1. A user generates a QR code containing private data: ```bash python scripts/qr.py --type wifi \ --ssid "PrivateNetwork" \ --password "SensitivePassword" ``` 2. The program formats the credentials into the QR payload. 3. After generating the image, the program writes the payload to standard error. 4. A terminal recorder, CI runner, Agent framework, or centralized logging service captures standard error. 5. Another user or service with access to those logs retrieves the password or personal data. ### Impact Assessment The issue can disclose up to the first 100 characters of a QR payload to entities that can access process logs. Exposed information may inclu ...[truncated 365 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: scripts/requirements.txt:4
Finding: Open-Ended Dependency Versions Prevent Reproducible and Reviewed Builds
Content: View full analysis
=7.4.0 # Enhanced QR code features (SVG, EPS, etc.) segno>=1.6.0 # Image processing (included with qrcode[pil]) Pillow>=10.0.0 ``` ### Technical Analysis All dependencies use open-ended minimum-version constraints. A future installation can therefore resolve to versions that did not exist and were not reviewed when the skill was audited. The package names correspond to the expected libraries, and the reviewed project does not reference an untrusted package index or an apparent typosquatted package. The risk arises from unrestricted future upgrades rather than evidence that the currently named packages are malicious. Python packages may execute code during installation and are imported by the application at runtime. If a future release is compromised, malicious, incompatible, or vulnerable, a fresh installation can consume it automatically. ### Attack Path 1. The project is installed at a later date using: ```bash pip install -r scripts/requirements.txt ``` 2. The package resolver selects the newest available versions satisfying the `>=` constraints. 3. Those versions may differ from the versions reviewed and tested by the project author. 4. A compromised or vulnerable dependency can execute during installation or when imported by `scripts/qr.py`. 5. Such code operates with the permissions of the user performing installation or running the skill. ### Impact Assessment The practical impact depends on the behavior of the dependency version selected during installation. A compromised dependency could potentially access files, environment variables, network resources, or process privileges available to the installing or executing account. There is no evidence in the reviewed project that the named dependencies are cu ...[truncated 177 chars]
Remediation: View remediation
segno== Pillow== ``` For stronger supply-chain controls: 1. Generate and commit a lock file using a controlled dependency-management tool. 2. Record hashes for every resolved distribution and install with `pip --require-hashes`. 3. Pin transitive dependencies as well as direct dependencies. 4. Install only from the official, explicitly configured package index. 5. Review release notes and security advisories before updating. 6. Use automated vulnerability scanning while requiring manual approval for upgrades. 7. Build and test dependencies in an isolated virtual environment. 8. Keep the documented installation commands consistent with the locked dependency set. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description largely matches the code's primary purpose and major capabilities: QR generation, supported payload types, color/logo customization, batch generation, and multiple export formats. However, the code also supports EPS export and terminal ASCII rendering, which are not mentioned in the description. These are additional undeclared capabilities. The declared installation requirement for OpenClawCLI is not reflected in the code, which instead directly depends on Python libraries (qrcode, Pillow, segno), but that is an environmental/setup mismatch rather than a behavioral capability mismatch. Overall the description is mostly accurate, but there is still a minor mismatch due to extra output capabilities not declared.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill encourages creation of QR codes containing secrets such as WiFi passwords and personal contact data without prominently warning that QR codes are easily copied, photographed, forwarded, and scanned by unintended parties. In this context, the omission increases the risk of credential disclosure and privacy leakage because the documented use cases include printable and shareable outputs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README explicitly demonstrates generating QR codes that embed WiFi passwords and personal contact details, but it does not warn that QR codes are easily shared, photographed, or scanned by unintended parties. In the context of a QR-generation skill, this omission can lead users to expose credentials and PII in a form that feels convenient but is not access-controlled.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This tool generates QR codes for sensitive content types such as WiFi credentials, contact cards, email payloads, and calendar/event data, then saves them to disk without clearly warning users that the resulting files may embed secrets or personal data. In shared environments, synced folders, build artifacts, or logs/screenshots of generated files, this can lead to unintended disclosure of credentials or PII even though the code does not directly exfiltrate data.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 92% confidence
Finding: The dependency specification for segno uses a minimum-version range instead of an exact pin, which makes builds non-reproducible and can allow an unexpectedly vulnerable or breaking future release to be installed. In a supply-chain context, unpinned dependencies increase exposure to malicious or compromised upstream releases, even though this file itself does not prove exploitation.
Content: Scanner excerpt · scripts/requirements.txt (reported line 7)May include surrounding context.
text
qrcode[pil]>=7.4.0 # Enhanced QR code features (SVG, EPS, etc.) segno>=1.6.0 # Image processing (included with qrcode[pil]) Pillow>=10.0.0

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: Pillow is unpinned, so installation may resolve to different versions over time, including versions with known security defects or future compromised releases. Because this skill processes image data for QR generation, Pillow is directly relevant to runtime behavior, making dependency drift more security-sensitive than a purely optional package.
Content: Scanner excerpt · scripts/requirements.txt (reported line 10)May include surrounding context.
text
segno>=1.6.0 # Image processing (included with qrcode[pil]) Pillow>=10.0.0

Unverifiable Dependency: Pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: The manifest includes Pillow without pinning to a specific version, and Pillow has a history of multiple security advisories including resource-consumption and potential code-execution issues in some versions. Since the actual installed version is unconstrained above 10.0.0, it is not possible to verify from this file alone that deployments will avoid affected releases, which creates a real supply-chain and runtime risk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.