Security audit

qrcode

Security checks across malware telemetry and agentic risk

Overview

This QR-code skill does the advertised QR work, but it needs review because it can auto-install dependencies, fetch remote URLs, and modify batch input files in place.

Install only if you are comfortable with the skill running pip or npm dependency installs, downloading any remote image URL you ask it to decode, and writing batch decode results back into your original CSV/XLSX files. Use an isolated environment, decode only trusted URLs, and run batch decode on copies of important spreadsheets.

SkillSpector

By NVIDIA

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (32)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill documents capabilities to read files, write files, and access the network, yet it declares no permissions. This creates a transparency and consent problem: an agent may perform environment-modifying or data-accessing actions that users and platforms are not clearly warned about, especially when remote URL decoding is supported.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The manifest and description present the skill as fully local, but the decode workflow explicitly supports downloading remote image URLs. That mismatch can mislead users into exposing network metadata or fetching attacker-controlled content when they believed no network activity would occur.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The skill instructs the agent to automatically run pip install or npm install without asking the user. Automatic package installation modifies the local environment and executes package-manager logic that may run install scripts or pull unreviewed dependencies, which exceeds the minimal need for simple QR processing.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The documentation claims all behavior is local and says no network requests occur, but elsewhere states that remote image URLs will be downloaded for decoding. This contradiction undermines informed consent and can cause unintended outbound requests to attacker-controlled servers.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The declared skill purpose is limited to local QR code generation/decoding, but the dependency list includes openpyxl, which adds spreadsheet parsing capability outside that scope. Unnecessary file-processing libraries expand the attack surface and, in this case, introduce known XML/XXE-related risk if spreadsheet handling is ever exposed or inadvertently used.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill is described as performing local QR decoding, but it accepts HTTP/HTTPS sources and downloads remote content before decoding. This creates an unexpected network boundary, enabling SSRF-like behavior, privacy leakage, and exposure to untrusted remote content that is not implied by a strictly local decoder.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The download helper fetches arbitrary user-provided URLs and follows redirects without validating the destination. In an agent or automation environment, this can be abused to access internal services or metadata endpoints, turning a QR-decoding utility into an SSRF primitive with access beyond the user's direct network context.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The script expands a supposedly local QR decode capability into remote content fetching and in-place file modification, which materially changes the trust and risk model. In an agent skill context, this can expose internal network resources to SSRF-style access and can alter user data files without clear consent, exceeding the declared scope of the skill.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Downloading arbitrary HTTP/HTTPS URLs from input data creates a network primitive that can be abused to reach attacker-controlled hosts or internal services, especially if the skill runs in a privileged environment. Because the fetched content is then processed as an image, this also increases exposure to malformed-file parsing risks in image libraries.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The documentation describes local batch decoding, but the implementation silently downloads remote URLs and can write back into the original source file. This mismatch is security-relevant because users and orchestrators may grant permissions based on the documented behavior and be unaware of network egress or destructive writes.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill is described as performing QR decoding locally, but it also accepts remote URLs and fetches them over the network. This creates a capability/behavior mismatch that can mislead users and downstream agents about privacy and network exposure, especially when submitted URLs may contain sensitive or internal resources.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The code performs arbitrary HTTP/HTTPS fetches on user-supplied URLs, which expands a local QR-decoding tool into a network-capable fetcher. In an agent context this can be abused for SSRF-like access to internal endpoints, unexpected egress, or retrieval of attacker-controlled content without adequate restrictions, validation, or limits.

Intent-Code Divergence

Low

Confidence: 88% confidence
Finding: The header states the decoder is local, while the documented and implemented usage supports URL inputs. This inconsistency is security-relevant because users may trust the tool with sensitive inputs under the false assumption that no network access occurs.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The file-level documentation claims decoding is local, but the implementation also accepts remote URLs and downloads them over the network. This creates a capability mismatch that can mislead users and calling agents into sending network requests in contexts where only local processing was expected, increasing privacy and SSRF-style exposure.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The download_image function fetches arbitrary HTTP/HTTPS URLs, which is a broader capability than a local QR decoder needs. In agent environments, this can be abused to trigger unexpected outbound requests to attacker-controlled or internal endpoints, potentially exposing metadata, internal network reachability, or sensitive usage patterns.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README states that remote image URLs may be downloaded locally for decoding, which introduces network access and SSRF-like risk in environments where the agent can reach internal resources. Even though the document mentions this behavior, it does not present it as a prominent safety warning with restrictions, validation, or consent requirements before fetching attacker-controlled URLs.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README says batch decode results are written back to the original file, which can silently modify user data and cause integrity loss if the wrong file or column is chosen. Without a clear caution, backup behavior, or writing to a new output file by default, users may not realize the skill is destructive rather than read-only.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: Automatic dependency installation occurs without a prominent warning even though it changes the local system state. For npm especially, installation may execute package lifecycle scripts, and both pip/npm can introduce supply-chain risk, making silent environment modification unsafe.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The batch decode workflow defaults to rewriting the original Excel/CSV file by adding a result column, without a prominent warning or safer default. Silent in-place modification can corrupt user data, overwrite important files, or violate user expectations when processing untrusted or valuable datasets.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script performs network downloads from attacker-controlled URLs without warning the user that local processing may cause outbound requests. This is dangerous because users may supply sensitive or internal-only URLs assuming purely local handling, causing unintended disclosure of network behavior and increasing SSRF risk in connected environments.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: Silent network access is dangerous in agent tooling because users may believe processing is fully local while the script makes outbound requests for every URL encountered. This can leak usage patterns, trigger access to sensitive internal endpoints, or violate expected privacy and sandbox boundaries.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The CSV processing path overwrites the original input file by default, which can cause unintended data loss or tampering if the file is user-owned or shared with other systems. In an agent setting, implicit destructive writes are especially risky because actions may be triggered automatically from natural-language requests.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The Excel path saves changes directly back to the source workbook without an explicit confirmation step. This can unexpectedly alter or corrupt important documents and is inconsistent with least-surprise principles for a utility that appears to perform read/decode operations.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script downloads remote content and writes it to a temporary file without any explicit warning or consent flow. Even if the temp file is later deleted, this can violate user expectations around privacy, local disk writes, and network access, and may leave traces if execution fails unexpectedly.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The code downloads remote content and writes it to a temporary file without any user-visible notice. While not a direct code-execution flaw by itself, the lack of disclosure can cause users or orchestrators to unintentionally permit network egress and local disk writes, which is especially risky in supposedly local-only workflows.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.