T09 · Insecure Skill Coding Practices
Error
- Location
scripts/batch_generate.py:23- Finding
Arbitrary File Overwrite Through Unvalidated Batch Filenames
- Content
View full analysis
- Remediation
View remediation
Security audit
Qr Code Toolkit
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent QR/barcode toolkit, but its batch generator can write outside the chosen output folder and its logging can expose sensitive QR contents such as WiFi passwords.
Review this skill before installing. Use it only in a dedicated working directory, avoid untrusted batch CSV/JSON files, do not run batch generation with privileged filesystem access, and assume terminal logs may contain QR payload data until logging is changed. Pin and review dependencies before using it in CI or sensitive environments.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_qr.py:43- Finding
WiFi Credentials Disclosed Through Standard Output
- Content
View full analysis
50 else ''}") print(f" Size: {img.size}") print(f" Error correction: {error_correction}") ``` ### Technical Analysis The WiFi QR format stores the password in plaintext in the `P:` field. Passing this payload to the generic `generate()` function causes the first 50 characters to be printed. Because the password occurs near the beginning of the payload, the output ordinarily reveals all or part of it. Truncation to 50 characters is not effective redaction. The generic logging also creates similar exposure risks for contact, payment, token, or other sensitive QR payloads. ### Attack Path 1. A user supplies an SSID and password to `generate_wifi.py`. 2. The script constructs a plaintext payload such as `WIFI:S:Office;T:WPA;P:secret123;;`. 3. The payload is passed to `generate()`. 4. `generate()` prints the first 50 characters to standard output. 5. The password is retained in a terminal capture, CI log, automation transcript, monitoring platform, or other standard-output collector. 6. A party with access to those rec ...[truncated 481 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Unpinned Dependencies Permit Unreviewed Package Updates
- Content
View full analysis
=7.4.2 pillow>=10.0.0 opencv-python>=4.8.0 pyzbar>=0.1.9 python-barcode>=0.15.1 numpy>=1.24.0 ``` ### Technical Analysis The `>=` constraints allow any future compatible or incompatible release above the stated minimum to be selected at installation time. No lock file or cryptographic hashes constrain the exact artifacts. Consequently, two installations performed at different times can receive materially different code without any modification to this project. If an upstream package account, release process, distribution channel, or selected package artifact is compromised, installation can introduce attacker-controlled code before the project receives another security review. Python packages may execute build-system code during installation and package code when imported. The audit found no evidence that the currently named packages are intentionally malicious; the issue is the absence of version and artifact controls. ### Attack Path 1. A future release of one of the accepted dependencies is compromised or otherwise contains malicious code. 2. The malicious release still satisfies the broad `>=` constraint. 3. A user follows the documented `pip install -r requirements.txt` command. 4. The package resolver selects and installs the unreviewed release. 5. Malicious build-time code executes during installation, or malicious runtime code executes when one of the toolkit scripts imports the package. ### Impact Assessment Dependency code executes with the privileges of the user or automation account performing install ...[truncated 372 chars]- Remediation
View remediation
pillow== opencv-python== pyzbar== python-barcode== numpy== ``` ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (20)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The supplied code chunk is limited to recognition/decoding functionality. It reads image files, decodes QR codes or barcodes using pyzbar, supports batch processing over a directory, and can save batch decode results to JSON. The declared description, however, presents the skill as an all-in-one toolkit covering generation, beautification, and multiple creation scenarios such as WiFi, contact cards, payments, and barcode generation. Those capabilities are not present in this code chunk. While batch recognition is consistent with the description, the broader declared purpose materially overstates the implemented functionality in this code sample.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description presents a comprehensive QR/barcode toolkit, but the supplied code chunk only performs single QR code generation. It does support limited customization via colors and sizing, which partially aligns with '美化' and generation claims, but it does not implement scanning/decoding, barcode support, batch operations, payment/WiFi/contact-specific helpers, or advanced beautification like logo embedding. The code’s actual scope is materially narrower than the declared purpose, so this is a description-behavior mismatch.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill advertises scripts that read input files and write output images/results, but the manifest does not declare any tool scope or allowed-tools boundaries. Missing capability declarations weaken least-privilege controls and make it harder for reviewers and runtime policy to constrain filesystem access appropriately.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This code writes a QR image containing the WiFi SSID and password to disk via the output path, but the only nearby user-facing message prints the SSID and security type. There is no confirmation prompt or warning in the docstring/comments that the generated file contains reusable network credentials and should be handled carefully.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documentation promotes camera-based QR scanning without warning that live camera input may capture sensitive surroundings, documents, or bystanders. In a user-facing skill, omission of privacy guidance can lead to unintentional exposure of personal or confidential information during use.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill advertises bulk generation/recognition and export workflows but does not warn that many user files may be read from and written to disk at once. This increases the chance of accidental processing of sensitive datasets, overwriting files, or broad data exposure if users misunderstand the scope of operation.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The dependency is specified with a lower bound only, so builds may resolve to different versions over time. That weakens reproducibility and makes it harder to verify whether a deployed version includes a vulnerable release or an unexpected breaking change from the package index or lock resolution process.
- Content
text qrcode>=7.4.2 pillow>=10.0.0 opencv-python>=4.8.0 pyzbar>=0.1.9
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
Pillow is declared as ">=10.0.0" rather than an exact version, which allows any newer release to be installed. For an image-processing skill, this increases supply-chain and patch-verification risk because the exact code being run is not fixed or auditable from this manifest alone.
- Content
text qrcode>=7.4.2 pillow>=10.0.0 opencv-python>=4.8.0 pyzbar>=0.1.9 python-barcode>=0.15.1
Unverifiable Dependency: pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
Pillow has multiple historical advisories, and because the manifest does not pin a specific version, it is impossible to verify from this file alone whether the installed release is safe. In this skill, Pillow processes attacker-controlled image content, which makes unverifiable patch status more concerning than in a non-parser dependency.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
OpenCV is a large native-code dependency and using an unpinned ">=" constraint means the installed version can vary between environments or over time. That makes builds non-reproducible and complicates assurance that vulnerable or unstable releases are excluded.
- Content
text qrcode>=7.4.2 pillow>=10.0.0 opencv-python>=4.8.0 pyzbar>=0.1.9 python-barcode>=0.15.1 numpy>=1.24.0
Unverifiable Dependency: opencv-python has 16 known advisory(ies) (CVE-2017-12864 (Integer Overflow or Wraparound in OpenCV); CVE-2017-12598 (Out-of-bounds Read in OpenCV ); CVE-2019-14493 (NULL Pointer Dereference in OpenCV.) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
opencv-python has many published advisories and is commonly used to parse complex image data. Since the manifest allows any version at or above a minimum, the actual installed build may still be vulnerable or otherwise unreviewed, and this cannot be determined statically from the file.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
pyzbar is also unpinned, so dependency resolution may select different releases across installations. This creates avoidable supply-chain uncertainty and makes vulnerability triage harder because the manifest does not identify the exact package version in use.
- Content
text qrcode>=7.4.2 pillow>=10.0.0 opencv-python>=4.8.0 pyzbar>=0.1.9 python-barcode>=0.15.1 numpy>=1.24.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
python-barcode is not pinned to a single version, which reduces reproducibility and weakens confidence that only reviewed code will be installed. While not an immediate exploit by itself, it is a real supply-chain hygiene issue.
- Content
text pillow>=10.0.0 opencv-python>=4.8.0 pyzbar>=0.1.9 python-barcode>=0.15.1 numpy>=1.24.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
NumPy is a widely used package with native components, and an unpinned version range means different environments may receive different code. This makes it difficult to confirm whether deployed instances are patched and increases exposure to dependency-related regressions or advisories.
- Content
text opencv-python>=4.8.0 pyzbar>=0.1.9 python-barcode>=0.15.1 numpy>=1.24.0
Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
NumPy has known advisories, and the unpinned requirement prevents verification that deployed versions are outside affected ranges. Although NumPy may be less directly exposed than the image decoders, it is still part of the processing pipeline and should be version-controlled for security assurance.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The module docstring uses a Chinese-only description ('二维码/条形码识别器'), which is a natural-language locale choice embedded in the skill without offering any language option or documenting a region-specific requirement. Under the policy rules, forcing a specific language without opt-in is a locale-policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The module docstring describes the tool in Chinese only: "条形码生成器 - 支持 EAN/UPC/Code128/Code39". This is a natural-language locale choice embedded in the file without any indication that users can opt into another language, which fits the language/locale policy violation category.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This code file contains user-facing natural language in Chinese ("基础二维码生成器") without any indication that the skill is region-specific or that language is user-selectable. Per the policy, forcing a specific language without opt-in can be a locale-policy violation even when it appears in code comments or docstrings.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file-level description uses Chinese ('vCard 名片二维码生成器') while the skill provides no indication that language selection is configurable or user-driven. This can violate a language/locale policy when a skill implicitly fixes output or documentation to a specific language without opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The natural-language description on L04 is written exclusively in Chinese, which can impose a specific language on users without any visible opt-in or indication that the tool is intended only for a Chinese-speaking context. This matches the policy category for language or locale constraints expressed in natural language.
- Content