My Generate Qr Code

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:15 AM UTC
• Version: 1.0.0

Overview

This QR-code skill does the expected image generation, but it can run unpinned pip installs automatically when the Python module is loaded.

Review before installing. The QR creation behavior is straightforward, but the skill should ideally remove automatic pip installation, declare pinned dependencies in installation metadata, and ask before writing to a default Desktop path. Install only if you are comfortable with a skill that may modify the agent's Python environment when loaded.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: agent.py:8

Finding

Automatic Installation of Unpinned Dependencies at Module Import

Content

View full analysis

Vulnerability Details

File Location: agent.py:8-16
Vulnerability Type: Unpinned runtime dependency installation
Risk Level: Medium

Vulnerable Code

python

# 自动安装依赖库（若用户未安装）
def install_dependencies():
    required_packages = ["qrcode", "pillow"]
    for package in required_packages:
        try:
            __import__(package)  # 检查库是否已安装
        except ImportError:
            # 自动安装缺失的库
            subprocess.check_call([sys.executable, "-m", "pip", "install", package])

# 初始化：安装依赖库
install_dependencies()

The behavior is also explicitly documented in SKILL.md:36-38:

markdown

- 未安装依赖库：自动尝试安装 qrcode 和 Pillow，若安装失败，提示用户手动执行“pip install qrcode pillow”；

Technical Analysis

Importing agent.py invokes install_dependencies() automatically. When a listed import is considered unavailable, the function executes pip install using an unconstrained package name. It does not pin versions, verify package hashes, require a trusted repository, or request user approval.

Consequently, package selection depends on the process environment and its configured pip indexes. A compromised index, malicious dependency release, or attacker-controlled package source could cause untrusted package installation or build logic to execute.

There is also an implementation error in the availability check: the distribution named pillow is normally imported as PIL, not pillow. Calling __import__("pillow") therefore generally raises ImportError even when Pillow is installed, causing a pip command to be launched whenever the module is loaded. Conversely, the top-level imports of qrcode and PIL occur before this installer runs, so genuinely missing dependencies may prevent the intended recovery mechanism from running at all.

Attack Path

1. The skill module is loaded by the Agent process.
2. Module initialization invokes install_dependencies().
3. A dependency is missing o ...[truncated 1193 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove dependency installation from module import and never modify the runtime environment merely by loading the skill.
2. Declare dependencies in a controlled deployment manifest or lockfile and install them before the Agent starts.
3. Pin exact reviewed versions of qrcode and Pillow.
4. Require package hashes, such as through a hash-locked requirements file and pip install --require-hashes.
5. Use an explicitly configured, trusted package repository rather than inheriting arbitrary pip index settings.
6. Perform dependency installation in an isolated virtual environment under a low-privilege deployment account.
7. If runtime installation is unavoidable, require explicit administrator or user approval and log the package name, version, source, and verified hash.
8. Correct dependency checks to inspect the actual import names, particularly PIL for Pillow.
9. Move any dependency diagnostics before application imports only as a non-installing check that produces a clear setup error.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The module adds an undocumented package-installation capability and executes it automatically on import, expanding the skill's authority beyond generating QR codes. This is dangerous because importing the skill can modify the environment, fetch packages from package indexes, and run package installation logic without explicit operator awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Automatically running pip without prior warning or confirmation violates least surprise and can lead to unintended network access, environment modification, and execution of package install hooks. In an agent-skill context, import-time side effects are especially risky because merely loading the skill triggers the behavior before a user has requested QR generation.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · agent.py (reported line 13)May include surrounding context.

python

required_packages = ["qrcode", "pillow"]
    for package in required_packages:
        try:
            __import__(package)  # 检查库是否已安装
        except ImportError:
            # 自动安装缺失的库
            subprocess.check_call([sys.executable, "-m", "pip", "install", package])

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 95% confidence

Finding

The skill invokes pip via subprocess during module execution, causing code/package-management actions outside the documented QR-generation purpose. Even though shell injection is not present because arguments are passed as a list, this still executes external package installation code without user consent and can introduce unreviewed dependencies or trigger network/package side effects at import time.

Content

Scanner excerpt · agent.py (reported line 16)May include surrounding context.

python

__import__(package)  # 检查库是否已安装
        except ImportError:
            # 自动安装缺失的库
            subprocess.check_call([sys.executable, "-m", "pip", "install", package])

# 初始化：安装依赖库
install_dependencies()

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly states that it will save generated QR images to a file, with a default location on the user's desktop, but does not require a clear user confirmation or warning before performing the write. This can lead to unexpected file creation in a sensitive or clutter-prone location and may surprise users who only asked to generate a QR code, especially if save paths are inferred or defaulted automatically.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

User-facing natural-language text in comments, docstrings, and returned messages is exclusively Chinese, with no indication of language selection or opt-in. This can violate a language/locale policy when skills are expected to avoid forcing a specific language by default.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The function creates directories and saves a PNG file to a default desktop path or a caller-provided location. While the return message reports where the file was saved after the fact, there is no prior user-facing warning in this file beyond the docstring that the operation will create directories and write files on disk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.