QR Code Decode

• Outcome: Pass
• Latest audit: May 28, 2026 · 2:18 PM UTC
• Version: 0.1.0

Overview

This skill is a simple QR/barcode decoder that sends selected images or image URLs to a clearly documented external service, so privacy caution is needed but the behavior is coherent.

Install only if you are comfortable sending QR/barcode images or image URLs to data.cli.im for processing. Avoid using it with passwords, private keys, login QR codes, personal documents, proprietary screenshots, internal URLs, or other sensitive content unless you trust the provider and its data handling.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (14)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README explicitly instructs agents to send image URLs, raw base64 image content, and uploaded files to a third-party endpoint, but provides no privacy, retention, consent, or data-handling warning. In an agent context, users may supply screenshots, documents, or photos containing secrets or personal data, so this omission materially increases the risk of unintentional sensitive-data exfiltration.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs users to send image URLs and base64-encoded local image contents to a third-party API, but it does not clearly warn that image data and any embedded sensitive information will leave the local environment. Because screenshots and photos often contain secrets, personal data, or internal assets, this creates a real privacy and data-handling risk rather than a purely informational issue.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Quick Start

```bash
curl -s -X POST https://data.cli.im/x-deepscan/vision/detect \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/qrcode.jpg"}'
```

• Confidence: 90% confidence
• Finding: The quick-start curl command is an actionable example for sending data to the external service, so it is not merely informational; it operationalizes exfiltration of user-supplied image inputs. In an agent ecosystem, copy-pastable examples increase the chance that data is transmitted without adequate review or consent.

External Transmission

Medium

• Category: Data Exfiltration

Content

QR code detection and decoding skill for AI agents. Upload an image (URL or base64), get structured results — decoded content, format, content type, position, and confidence.

**Service URL:** `https://data.cli.im/x-deepscan/vision`

## Quick Start

• Confidence: 88% confidence
• Finding: The documented service URL establishes that the skill depends on a remote third-party endpoint rather than purely local processing. That is a real security concern because agents may invoke the skill under the assumption that image analysis is local, causing unnoticed disclosure of user-provided content or metadata to an external operator.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Quick Start

```bash
curl -s -X POST https://data.cli.im/x-deepscan/vision/detect \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/qrcode.jpg"}'
```

• Confidence: 90% confidence
• Finding: The quick-start curl command is an actionable example for sending data to the external service, so it is not merely informational; it operationalizes exfiltration of user-supplied image inputs. In an agent ecosystem, copy-pastable examples increase the chance that data is transmitted without adequate review or consent.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Single URL
curl -s -X POST https://data.cli.im/x-deepscan/vision/detect \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/photo.jpg"}'

• Confidence: 90% confidence
• Finding: This API example sends an image URL to the third-party service, which can expose both the target image and associated request metadata to the external operator. If agents pass internal or pre-signed URLs, this may also leak private resources or indirectly reveal infrastructure details.

External Transmission

Medium

• Category: Data Exfiltration

Content

-d '{"url": "https://example.com/photo.jpg"}'

# Single base64
curl -s -X POST https://data.cli.im/x-deepscan/vision/detect \
  -H "Content-Type: application/json" \
  -d "{\"image\": \"$(base64 -i photo.jpg)\"}"

• Confidence: 95% confidence
• Finding: This example uploads raw base64-encoded image content directly to the external service, which is a stronger exfiltration vector than passing a public URL because the full image bytes are transmitted off-platform. Screenshots and photos commonly contain credentials, QR login tokens, PII, payment codes, or internal documents, making this particularly risky in agent-driven workflows.

External Transmission

Medium

• Category: Data Exfiltration

Content

-d "{\"image\": \"$(base64 -i photo.jpg)\"}"

# Batch URLs
curl -s -X POST https://data.cli.im/x-deepscan/vision/detect \
  -H "Content-Type: application/json" \
  -d '{"urls": ["https://example.com/1.jpg", "https://example.com/2.jpg"]}'
```

• Confidence: 89% confidence
• Finding: The batch URL example encourages sending multiple image references to the third-party endpoint at once, increasing the scale of possible data disclosure. Bulk processing magnifies impact because a single action can leak many user assets or internal links without granular review.

External Transmission

Medium

• Category: Data Exfiltration

Content

File upload (alternative):

```bash
curl -X POST https://data.cli.im/x-deepscan/vision/detect/upload -F "file=@photo.jpg"
```

## Agent SKILL

• Confidence: 94% confidence
• Finding: The file upload endpoint explicitly instructs users to send local image files to the remote service, creating a direct path for sensitive local content to leave the user's environment. In an agent skill, local files may include screenshots, documents, or photos chosen by the user without understanding that they are being uploaded to a third party.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# From URL (simplest)
curl -s -X POST https://data.cli.im/x-deepscan/vision/detect \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/photo-with-qrcode.jpg"}'

• Confidence: 93% confidence
• Finding: The curl example normalizes sending image-related data to a third-party domain without any accompanying warning or approval flow. In context, the skill is specifically designed to extract encoded content from images, which may encourage users to upload screenshots containing secrets, making the external transmission more dangerous than a generic web request.

External Transmission

Medium

• Category: Data Exfiltration

Content

## API

**Endpoint:** `POST https://data.cli.im/x-deepscan/vision/detect`

**Content-Type:** `application/json`

• Confidence: 90% confidence
• Finding: The declared API endpoint is an external service, meaning use of the skill inherently depends on sending data outside the user's environment. In a skill that processes screenshots, photos, and local files, that external transfer is security-relevant because the inputs may contain confidential or regulated data.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# From URL (simplest)
curl -s -X POST https://data.cli.im/x-deepscan/vision/detect \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/photo-with-qrcode.jpg"}'

• Confidence: 93% confidence
• Finding: The curl example normalizes sending image-related data to a third-party domain without any accompanying warning or approval flow. In context, the skill is specifically designed to extract encoded content from images, which may encourage users to upload screenshots containing secrets, making the external transmission more dangerous than a generic web request.

External Transmission

Medium

• Category: Data Exfiltration

Content

-d '{"url": "https://example.com/photo-with-qrcode.jpg"}'

# From local file (base64)
curl -s -X POST https://data.cli.im/x-deepscan/vision/detect \
  -H "Content-Type: application/json" \
  -d "{\"image\": \"$(base64 -i photo.jpg)\"}"

• Confidence: 97% confidence
• Finding: This example uploads a local file as base64 to a remote API, which is a stronger data-exfiltration concern than passing a public URL because it can transmit private local content directly off-host. Users may not realize that local screenshots, IDs, invoices, or internal documents are being sent to a third party for processing.

External Transmission

Medium

• Category: Data Exfiltration

Content

-d "{\"image\": \"$(base64 -i photo.jpg)\"}"

# Batch
curl -s -X POST https://data.cli.im/x-deepscan/vision/detect \
  -H "Content-Type: application/json" \
  -d '{"urls": ["https://example.com/1.jpg", "https://example.com/2.jpg"]}'
```

• Confidence: 91% confidence
• Finding: The batch example scales the same external transmission behavior to multiple images, increasing the volume of potentially sensitive data exposed in a single operation. This amplifies privacy, compliance, and accidental oversharing risks, especially if users submit many screenshots or internal assets at once.

Static analysis

No suspicious patterns detected.