T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/generate.mjs:10- Finding
Output Root Resolves Outside the Project Boundary
- Content
View full analysis
- Remediation
View remediation
Security audit
QRCode
Security checks for vulnerabilities and agentic risk
Overview
The QR code skill mostly matches its stated purpose, but its file-output controls are incorrectly scoped and can write outside the intended workspace.
Review this skill before installing. It should be fixed to write only to a real user-approved workspace or dedicated output directory, create temporary files safely, cap image sizes more conservatively, pin dependencies with a lockfile, and warn users not to put WiFi passwords, contact details, or other sensitive data into QR codes unless they intend to share it.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate.mjs:173- Finding
Predictable Temporary File Is Written Before Symlink Validation
- Content
View full analysis
.tmp. -> ``` 3. The generator calls `fs.writeFileSync()` on that pathname. 4. Node follows the symbolic link and writes ...[truncated 1148 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate.mjs:13- Finding
Permitted Image Dimensions Enable Resource Exhaustion
- Content
View full analysis
LIMITS.SIZE * LIMITS.SCALE) { exitError(`Error: Computed size too large (${svgSize}px). Reduce size, scale, or margin.`); } ``` ```js let image = sharp(svgBuffer, { density: 72, limitInputPixels: LIMITS.SIZE * LIMITS.SIZE * LIMITS.SCALE * LIMITS.SCALE }).resize(svgSize, svgSize, { fit: 'contain' }); ``` ### Technical Analysis The script accepts a maximum size of 10,000 and a maximum scale of 10. These values can combine into a final dimension approaching 100,000 pixels on each axis. The `sharp` input limit is calculated as: ```text 10,000 × 10,000 × 10 × 10 = 10,000,000,000 pixels ``` A 100,000 by 100,000 image contains ten billion pixels. Even a simple uncompressed four-byte-per-pixel representation would require approximately 40 GB before accounting for intermediate buffers, encoder state, SVG rendering, and process overhead. The existing validation only limits each final dimension to `SIZE * SCALE`. It does not impose a practical cap on total pixels, memory usage, output bytes, execution time, or concurrent conversions. The nominal resource limit is therefore too permissive to prevent denial of service. ### Attack Path 1. An untrusted caller requests raster output ...[truncated 1167 chars]- Remediation
View remediation
MAX_OUTPUT_PIXELS) { exitError('Error: Requested image exceeds the maximum pixel count'); } ``` - Pass the same conservative total-pixel threshold to `sharp` rather than allowing ten billion pixels. - Reduce the maximum final dimension to a deployment-appropriate value, such as 4,096 or 8,192 pixels. - Avoid independently large `size` and `scale` values that multiply into an unsafe final dimension. - Apply execution time, process-memory, and output-file-size limits at the worker or container level. - Limit concurrent image conversions. - Consider generating the raster image directly at the requested safe dimensions rather than building oversized intermediate representations. - Add boundary tests for maximum dimensions and verify that oversized requests fail before invoking `sharp`. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (7)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The examples include QR payloads containing WiFi credentials and personal contact data, but the skill does not warn users that generated QR codes may expose secrets or personally identifiable information to anyone who scans or views them. In this context, the risk is realistic because the skill explicitly encourages rendering and sharing the generated files, which increases the chance of accidental disclosure.
- Content
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md ## Troubleshooting | Issue | Solution | | ------------------- | -------------------------------------------------------------------------------------------------------------------------- | | `npm install` fails | Install build tools:`xcode-select --install` (macOS) or see [sharp install guide](https://sharp.pixelplumbing.com/install) | | QR code won't scan | Increase `--size`, use higher error correction (`--ec H`), or simplify styling |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | QR code won't scan | Increase `--size`, use higher error correction (`--ec H`), or simplify styling | | Colors not working | Use hex format `#RRGGBB` (e.g., `#FF5733`), not RGB or color names | | File too large | Reduce `--size`, `--scale`, or increase `--quality` for JPG | | Permission denied | Check workspace directory write permissions | ## Error Correction Levels Explained
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The dependency version for qrcode uses a caret range (^1.5.1), which allows automatic installation of newer minor and patch releases. This weakens build reproducibility and can unintentionally pull in a compromised or breaking upstream release through the software supply chain.
- Content
json "generate": "node scripts/generate.mjs" }, "dependencies": { "qrcode": "^1.5.1", "sharp": "^0.32.4" }, "author": "",
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The sharp dependency is specified with a caret range (^0.32.4), so installs may resolve to different releases over time. For a package with native components and prior security advisories, this increases supply-chain risk and makes it harder to verify whether deployed builds are affected by known issues.
- Content
json }, "dependencies": { "qrcode": "^1.5.1", "sharp": "^0.32.4" }, "author": "", "license": "MIT"
Unverifiable Dependency: sharp has 4 known advisory(ies) (GHSA-54xq-cgqr-rpm3 (sharp vulnerability in libwebp dependency CVE-2023-4863); GHSA-f88m-g3jw-g9cj (sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-); CVE-2022-29256 (sharp vulnerable to Command Injection in post-installation over build environmen) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
The manifest includes sharp without pinning an exact version, while the package has multiple known advisories in some releases. Because the resolved installed version is not fixed here, consumers may unknowingly install an affected version, which is more concerning given sharp's native tooling and historical post-install/build-related security issues.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This code performs a direct file write and atomic rename to the target output path, which can overwrite an existing file in the workspace root. While the script logs the destination path and success, it does not warn the user that an existing file may be replaced or prompt for confirmation before doing so.
- Content
Static analysis
No suspicious patterns detected.