二维码识别工具

• Risk level: Low
• Analyzed: May 2, 2026, 4:46 AM
• Findings: 1
• Version: 1.2.5

Overview

This appears to be a straightforward local QR/barcode reader with only a minor dependency/provenance note.

This skill looks safe for its intended local QR/barcode-reading use. Before installing, verify the Pillow, pyzbar, and zbar dependencies come from trusted sources, and remember that decoded QR/barcode contents will be printed to the terminal or saved if you choose the save option.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI04: Agentic Supply Chain Vulnerabilities

Low

What this means

Installing these dependencies can change the local Python/system environment, so users should use trusted package managers and be careful about package names.

Why it was flagged

The skill relies on manually installed third-party Python packages and a native zbar library, but no pinned versions or install spec are provided.

Skill content

- Pillow (pip install Pillow)
- pyzbar (pip install pyzbar)
  - macOS: `brew install zbar`
  - Ubuntu: `sudo apt-get install libzbar0`

Recommendation

Install dependencies from official or trusted repositories, consider using a virtual environment, and pin versions if reproducibility matters.