ClawHub
Back to skill

Security audit

QR Code Decode

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple QR/barcode decoding guide that uses a disclosed remote API, with privacy caution needed for images sent to that service.

Install only if you are comfortable sending selected image URLs, base64 image data, or uploaded image files to data.cli.im for processing. Avoid using it on confidential screenshots, identity documents, private URLs, credentials, or regulated data unless you have approved that external processing.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (14)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README directs users to send image URLs, raw base64 image content, and uploaded files to a third-party service, but it does not warn that potentially sensitive image data and decoded QR/barcode contents will leave the local environment. In an agent skill context, this omission is more dangerous because users may assume local processing while the agent silently exfiltrates screenshots, documents, or photos to a remote endpoint.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 5)May include surrounding context.

md
QR code detection and decoding skill for AI agents. Upload an image (URL or base64), get structured results — decoded content, format, content type, position, and confidence.

**Service URL:** `https://data.cli.im/x-deepscan/vision`

## Quick Start

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

This duplicate detection again reflects a concrete example of sending image data references to an external service. The danger is contextual: an agent using this skill may process screenshots or photos containing secrets, credentials, PII, or internal documents and transmit them off-platform.

Content

Scanner excerpt · README.md (reported line 10)May include surrounding context.

Quick Start

bash
curl -s -X POST https://data.cli.im/x-deepscan/vision/detect \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/qrcode.jpg"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

This duplicate detection again reflects a concrete example of sending image data references to an external service. The danger is contextual: an agent using this skill may process screenshots or photos containing secrets, credentials, PII, or internal documents and transmit them off-platform.

Content

Scanner excerpt · README.md (reported line 10)May include surrounding context.

Quick Start

bash
curl -s -X POST https://data.cli.im/x-deepscan/vision/detect \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/qrcode.jpg"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The single-URL example causes the remote service to fetch/process image content based on a provided URL, which still results in external processing of user data and may leak internal or sensitive image locations if misused. In an agent workflow, this can broaden exposure because URLs themselves may reveal private infrastructure or temporary signed links.

Content

Scanner excerpt · README.md (reported line 23)May include surrounding context.

bash
# Single URL
curl -s -X POST https://data.cli.im/x-deepscan/vision/detect \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/photo.jpg"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

The base64 example transmits the full raw image contents directly to the external service, which is a stronger privacy risk than passing a public demo URL. Screenshots and photos commonly contain secrets, PII, financial data, health data, or internal information, and the README does not provide any caution or handling guarantees.

Content

Scanner excerpt · README.md (reported line 28)May include surrounding context.

md
-d '{"url": "https://example.com/photo.jpg"}'

# Single base64
curl -s -X POST https://data.cli.im/x-deepscan/vision/detect \
  -H "Content-Type: application/json" \
  -d "{\"image\": \"$(base64 -i photo.jpg)\"}"

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The batch URL example enables multiple external transmissions in one request, potentially scaling privacy exposure and accidental bulk disclosure. In agent use, this increases the blast radius if a user points the tool at many screenshots or image links without understanding that all are processed remotely.

Content

Scanner excerpt · README.md (reported line 33)May include surrounding context.

-d "{"image": "$(base64 -i photo.jpg)"}"

Batch URLs

curl -s -X POST https://data.cli.im/x-deepscan/vision/detect
-H "Content-Type: application/json"
-d '{"urls": ["https://example.com/1.jpg", "https://example.com/2.jpg"]}'

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

The file upload example sends a local file directly to the third-party service, which can expose the entire contents of a user-selected image and any embedded metadata. In an agent setting, local file upload is especially sensitive because users may provide private screenshots, identity documents, or confidential workplace images expecting tool assistance rather than off-device transfer.

Content

Scanner excerpt · README.md (reported line 60)May include surrounding context.

File upload (alternative):

bash
curl -X POST https://data.cli.im/x-deepscan/vision/detect/upload -F "file=@photo.jpg"

Agent SKILL

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs users to send image data and image URLs to a third-party endpoint, but the description and usage guidance do not clearly warn about that external data transfer. This creates a privacy and data-governance risk because users may submit screenshots, local files, or URLs containing sensitive information without informed consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The endpoint declaration establishes that all decoding requests are performed by a remote third-party service. This matters because any submitted image or metadata is exposed to an external processor, with attendant confidentiality, compliance, and retention risks.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md
## API

**Endpoint:** `POST https://data.cli.im/x-deepscan/vision/detect`

**Content-Type:** `application/json`

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The documented curl usage transmits user-controlled input to data.cli.im, which is an external boundary crossing. In context this is functional rather than overtly malicious, but it remains a real security concern if users assume processing is local or submit confidential screenshots.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

bash
# From URL (simplest)
curl -s -X POST https://data.cli.im/x-deepscan/vision/detect \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/photo-with-qrcode.jpg"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The documented curl usage transmits user-controlled input to data.cli.im, which is an external boundary crossing. In context this is functional rather than overtly malicious, but it remains a real security concern if users assume processing is local or submit confidential screenshots.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

bash
# From URL (simplest)
curl -s -X POST https://data.cli.im/x-deepscan/vision/detect \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/photo-with-qrcode.jpg"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This example base64-encodes a local file and posts it to an external service, explicitly enabling exfiltration of local image contents. The risk is higher than URL-only input because local screenshots or photos often contain sensitive material such as credentials, documents, or internal system information.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md
-d '{"url": "https://example.com/photo-with-qrcode.jpg"}'

# From local file (base64)
curl -s -X POST https://data.cli.im/x-deepscan/vision/detect \
  -H "Content-Type: application/json" \
  -d "{\"image\": \"$(base64 -i photo.jpg)\"}"

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

The batch example enables bulk transmission of multiple image URLs to the external API, increasing the volume of potentially sensitive data disclosed in one operation. This amplifies privacy and compliance impact if misused or if operators are unaware that processing is remote.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

-d "{"image": "$(base64 -i photo.jpg)"}"

Batch

curl -s -X POST https://data.cli.im/x-deepscan/vision/detect
-H "Content-Type: application/json"
-d '{"urls": ["https://example.com/1.jpg", "https://example.com/2.jpg"]}'

text