Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed CodeBox QR-code API integration, with the main caution that dynamic QR codes collect scan analytics.
Before installing, understand that dynamic QR codes are trackable, cost credits, and may collect analytics about people who scan them, including device and location-derived information. Use static QR codes when tracking is unnecessary, protect the CodeBox API key, and confirm update or delete actions before applying them to important QR codes.
The skill prominently advertises tracking and analytics for QR scans, including device, location, time, and event history, but does not warn users that dynamic QR codes collect potentially sensitive visitor telemetry. This can lead users to enable tracking without informed consent, creating privacy, compliance, and trust risks, especially where personal data collection is regulated.
The skill is designed to transmit user-provided QR content and management actions, plus API credentials, to an external third-party service via curl. While expected for an API integration, this is still a real security and privacy boundary because user data and tracking configuration leave the local environment and are processed by an external provider.
env:
- CODEBOX_API_KEY
bins:
- curl
primaryEnv: CODEBOX_API_KEY
emoji: "📱"
homepage: https://www.codebox.club
The analytics endpoint explicitly returns device, browser, OS, time-series, and location statistics, yet the documentation presents this as a routine feature without any privacy or data-handling warning. That omission increases the chance of misuse or non-compliant collection of user telemetry because operators are not prompted to consider notice, consent, or data minimization.
Exporting scan events can expose detailed usage records that may include timestamps, behavioral history, and potentially location-related metadata, but the skill does not warn about the sensitivity of exported data. This raises the risk of over-collection, insecure downstream storage, or sharing of visitor activity data without appropriate safeguards.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Rules
- Always use `$CODEBOX_API_KEY` from environment, never ask the user for it inline.
- Default to `DYNAMIC` mode unless the user explicitly asks for static QR codes.
- When the user describes a style (e.g. "Christmas themed", "blue ocean"), use the `keywords` parameter in the generate call for automatic template matching, or call the catalog endpoint first to find a matching `templateId`.
- Dynamic QR codes consume 1 credit per generation. Static QR codes are free.
The skill advertises scan analytics, scan event export, and webhook capabilities that can expose privacy-sensitive data such as device details, browser/OS metadata, location, and timestamps, but the reference provides no guidance on consent, minimization, retention, or secure handling. In a QR-code tracking skill, this omission increases the likelihood that downstream agents or users will collect and process personal data unsafely or in violation of privacy expectations.