Security audit

qrcode-remote

Security checks across malware telemetry and agentic risk

Overview

This QR-code skill is coherent and not malicious, but it uses a third-party QR API and can modify batch spreadsheet inputs.

Install only if you are comfortable with QR contents, image URLs, and fallback-decoded local images being sent to api.2dcode.biz. Avoid secrets, private links, internal URLs, personal data, or regulated documents, and back up spreadsheets before batch decoding because the default flow writes results into the original file.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (34)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to automatically run pip/npm installs without user approval, which modifies the local environment beyond the core QR task. Auto-installation can introduce supply-chain risk, unexpected code execution during package install, and persistent changes to the host system.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The package includes `xlsx` and `archiver`, which are not justified by the stated QR-code generation/decoding purpose and materially expand the attack surface. This is especially concerning here because `xlsx` is also flagged separately as known vulnerable, so the unexpected dependency is not just unused bloat but a potentially exploitable capability unrelated to the advertised skill.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The QR-code skill declares an Excel-processing dependency (`openpyxl`) that is not obviously required for generating or decoding QR codes. Unnecessary parsing libraries expand the attack surface, and spreadsheet/XML parsers are historically risky because untrusted files can trigger XXE, resource exhaustion, or parser bugs if the package is ever invoked.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The script overwrites the original CSV/Excel input by appending a decoded-results column when --output-txt is not provided. That behavior can unexpectedly modify user documents, destroy provenance, and cause accidental data loss or corruption, especially in an agent setting where users may expect decoding only, not in-place editing.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The downloader fetches arbitrary user-supplied URLs and follows redirects, then stores the response in a temporary local file for processing. This creates SSRF-like behavior and can be abused to make the environment access attacker-chosen hosts, including internal services or large/unexpected resources, especially if the skill runs in a privileged network context.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The code accepts local file paths and, when local ZXing decoding is unavailable or fails, falls back to uploading those local image files to a third-party API. That creates an unexpected data exfiltration path for local content, especially because the skill description focuses on QR decoding but does not clearly disclose remote transmission of local files.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README says decoding is local-first and mentions temporary uploads, but it does not clearly warn users that decode fallback may send user-provided images or image URLs to a third-party service. This can expose sensitive QR contents, embedded tokens, internal URLs, or private images without sufficiently explicit user awareness or consent.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The README advertises saving files locally and batch decoding that writes results back to the original file, but the surrounding documentation does not clearly warn users that existing files may be modified or overwritten. In an agent context, understated data-impacting behavior increases the risk of unintended file changes, corruption, or privacy exposure when users think the skill is read-only.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill tells the agent to run package managers automatically without warning that this will alter the local system. That lack of notice undermines informed consent and can lead to unintended installation scripts, dependency drift, or system changes the user did not authorize.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The batch decode flow defaults to rewriting the user's original Excel/CSV file by adding a results column, without an explicit warning or confirmation. Silent in-place modification risks data corruption, audit issues, and loss of user trust if the original file must remain unchanged.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation instructs users to send either an image URL or an uploaded image file to a third-party QR decoding API, but it provides no warning that the image content and metadata will be disclosed to an external service. In a skill context, users may reasonably assume local processing, so this omission can lead to unintended exfiltration of sensitive images or internal URLs.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: When local decoding fails, the script sends the QR image URL or file contents to api.2dcode.biz without any explicit user-facing consent or warning. QR codes can encode sensitive information, so this behavior can leak private data and documents to a third-party service outside the user's trust boundary.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The script may overwrite the original CSV/Excel file with added decoded content and does not present a clear warning or require confirmation. In an agent workflow, silent in-place edits to user files are risky because they can alter important records and make rollback difficult.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: This function reads arbitrary local files and uploads their full contents to https://api.2dcode.biz/ for decoding without any user-facing warning, consent flow, or policy gate. If users point it at sensitive local images, confidential data may be disclosed to an external service, and the skill context makes this more dangerous because batch processing can exfiltrate many files in one run.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The function transmits user-supplied image URLs to a third-party QR decoding API without clearly informing the user that those URLs, and indirectly the referenced content, are being shared externally. While sending a URL is less severe than uploading a local file, it still exposes user data and can leak internal or sensitive URLs if the input is not strictly public.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: In image mode, the script will send QR payload data to the remote CaoLiao API either when the user explicitly selects --use-api or silently as a fallback if local generation fails. QR contents often contain URLs, tokens, contact details, or other sensitive data, so transmitting them to a third party without an explicit warning or confirmation creates a real privacy and data-exposure risk.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: In image mode, the script silently falls back to a remote QR-code API if local generation fails, which transmits the QR payload data to a third party. Because the input may come from user files and could contain sensitive URLs, tokens, or internal identifiers, this creates an undisclosed data exfiltration/privacy risk rather than a purely functional fallback.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: If local decoding fails, the script automatically uploads the local image file to a third-party QR decoding API without an explicit warning or consent step. This can expose sensitive local files or embedded data in images to an external service, which is especially risky in an agent skill where users may assume processing is local-first and private.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script sends user-supplied image URLs to a third-party API for decoding without explicit disclosure. Even though it transmits a URL instead of file contents, this may reveal private, signed, internal, or otherwise sensitive resource locations to the external service and can violate user expectations about where data is processed.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: When local decoding fails or when --force-api is used, the script uploads a user-supplied local file to a third-party QR decoding service. This creates a real privacy and data-exfiltration risk because the image may contain sensitive information beyond the QR code, and the code does not present a clear consent prompt or warning before transmission.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script sends the full QR payload provided via --data to a third-party API endpoint to generate the code, but it does not provide any user-facing warning or consent step about this network transfer. In a skill intended for QR creation, users may reasonably assume local generation, so sensitive text, URLs, tokens, or secrets could be disclosed externally without clear notice.

External Transmission

Medium

Category: Data Exfiltration
Content: ## 生成二维码 API **端点：** `GET https://api.2dcode.biz/v1/create-qr-code` 直接返回二维码图片（非 JSON），可嵌入 `<img>` 标签或 Markdown 图片语法中。
Confidence: 84% confidence
Finding: https://api.2dcode.biz/

External Transmission

Medium

Category: Data Exfiltration
Content: ### 完整 URL 示例 ``` https://api.2dcode.biz/v1/create-qr-code?data=https%3A%2F%2Fexample.com&size=400x400&format=png&error_correction=H&border=2 ``` ---
Confidence: 80% confidence
Finding: https://api.2dcode.biz/

External Transmission

Medium

Category: Data Exfiltration
Content: ## 解码二维码 API **端点：** `https://api.2dcode.biz/v1/read-qr-code` ### GET 方式
Confidence: 88% confidence
Finding: https://api.2dcode.biz/

External Transmission

Medium

Category: Data Exfiltration
Content: 通过图片 URL 解码。 ``` GET https://api.2dcode.biz/v1/read-qr-code?file_url=<URL编码的图片地址> ``` **参数：**
Confidence: 90% confidence
Finding: https://api.2dcode.biz/

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.