Cli Qr Refiner

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 12:57 AM UTC
• Version: 2.0.0

Overview

This skill is a narrow local QR-code image converter with some handling and robustness caveats, but no evidence of hidden, destructive, persistent, or exfiltrating behavior.

Before installing, treat generated QR text and PNGs as potentially sensitive, especially for login or verification flows. Use private temporary paths with restrictive permissions, delete the source and output files after use, and avoid feeding unusually large inputs or scale values to the renderer.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/cli_qr_refiner.py:26

Finding

Unbounded Image Allocation Enables Local Resource Exhaustion

Content

View full analysis

Vulnerability Details

File Location: scripts/cli_qr_refiner.py, lines 26–38 and 70–74
Vulnerability Type: Uncontrolled resource consumption
Risk Level: Medium

Vulnerable Code

python

with open(input_path, 'r', encoding='utf-8') as f:
    lines = [line.rstrip('\n') for line in f if line.strip()]

if not lines:
    print(f"[QR-Renderer] Error: empty input file '{input_path}'")
    sys.exit(1)

height = len(lines)
width = max(len(line) for line in lines)

# Each char cell: width = scale, height = scale * 2
# (half blocks ▀ ▄ are half-height, so we double the scale for proper rendering)
cell_w = scale
cell_h = scale * 2

img = Image.new('RGB', (width * cell_w, height * cell_h), color='white')

python

if __name__ == '__main__':
    if len(sys.argv) < 3:
        print("Usage: python3 cli_qr_refiner.py <input_txt> <output_png> [scale]")
        sys.exit(1)

    input_file = sys.argv[1]
    output_file = sys.argv[2]
    scale = int(sys.argv[3]) if len(sys.argv) > 3 else 10

    render_qr(input_file, output_file, scale)

Technical Analysis

The renderer does not impose limits on input-file size, row count, line width, scale, or total output dimensions. It first loads all nonblank input lines into memory and then allocates an RGB image whose dimensions are calculated from attacker-influenced values:

• Image width: maximum_line_length × scale
• Image height: line_count × scale × 2
• Approximate raw RGB storage: image_width × image_height × 3 bytes, excluding Pillow and Python overhead

An unusually large input matrix, an excessive positive scale, or both can therefore trigger excessive memory and CPU consumption. A non-positive scale can also produce an unhandled Pillow exception rather than a controlled validation error.

Exploitation requires the attacker to influence the QR text processed by the Skill or the optional scale argument. No r ...[truncated 1378 chars]

Remediation

View remediation

Remediation Suggestions

• Validate that scale is an integer within a conservative positive range, such as 1 through 50.
• Reject input files exceeding a defined byte-size limit before reading them fully.
• Read incrementally and enforce explicit maximum row-count and column-count limits.
• Calculate output dimensions before image creation and reject zero, negative, or excessive dimensions.
• Enforce a maximum total-pixel budget, using checked calculations before calling Image.new().
• Catch ValueError, OSError, Pillow decompression/allocation errors, and MemoryError, then return a controlled nonzero exit status without exposing a traceback.
• Where available, run the renderer with operating-system memory, CPU, and execution-time limits.
• Document the accepted input and scale limits in SKILL.md.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The skill instructs agents to save captured QR blocks to a temporary file without warning that terminal QR codes often represent authentication, login, or verification material. Writing such data to predictable or persistent temporary locations can unnecessarily expose sensitive session artifacts to other local users, logs, backups, or later processes on shared systems.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.