Pipeworx qrcode

Generate QR code images from text or URLs and decode QR codes from public image URLs without configuration.

Security Scan

The skill's described purpose (generate/decode QR codes) matches its instructions, but it routes all data (text and image URLs) to an external, undocumented gateway (gateway.pipeworx.io) with no source or homepage to verify — this can expose sensitive data and is worth caution.

Purpose & Capability

Name and description (create and read QR codes) align with the SKILL.md examples which call a QR code service (create_qr/read_qr) at gateway.pipeworx.io. There are no unrelated binaries or credentials requested.

Instruction Scope

The runtime instructions explicitly instruct the agent to POST arbitrary text payloads and image URLs to https://gateway.pipeworx.io/qrcode/mcp. That is exactly what is needed to implement QR generation/decoding, but the instructions give the agent broad discretion to send any data or image URLs to a third party. There is no local fallback or option to run these operations locally, and no limits on the kinds of data that will be transmitted.

Install Mechanism

Instruction-only skill with no install steps or code to write to disk. This is low-risk from a code-install perspective.

Credentials

The skill requests no environment variables or credentials (proportional), but because it sends user-provided content to an external API, lack of credentials does not mitigate privacy risk: sensitive text or images you supply (or that the agent finds) will be transmitted to an external, undocumented service.

Persistence & Privilege

always is false and there are no install-time modifications or requests to persist credentials or change other skills' configs. The skill can be invoked autonomously (platform default), which increases blast radius if combined with other concerns but is not by itself unusual.

What to consider before installing

This skill is coherent with its stated purpose, but it relies entirely on an external endpoint (gateway.pipeworx.io) that has no listed source or homepage. Before installing: 1) Be aware that any text you encode or image URLs you give will be sent to that third-party service — do NOT send secrets or private images. 2) If you need stronger guarantees, prefer a local QR library or a known trusted service. 3) If you still want to use this skill, test it with only non-sensitive data first and consider restricting autonomous invocation or network access until you verify the gateway's trustworthiness.

QR Code

Generate and decode QR codes. Two tools, zero configuration.

create_qr encodes any text or URL into a QR code image URL (10px to 1000px). read_qr decodes a QR code from any publicly accessible image URL.

Quick start

Generate a QR code for a URL:

curl -X POST https://gateway.pipeworx.io/qrcode/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"create_qr","arguments":{"data":"https://example.com","size":300}}}'

The response contains a url field you can embed directly in <img> tags or download.

Decoding

Pass any image URL containing a QR code to read_qr and get the decoded text back. Works with PNGs, JPEGs, and most common image formats.

{
  "mcpServers": {
    "qrcode": {
      "url": "https://gateway.pipeworx.io/qrcode/mcp"
    }
  }
}