T09 · Insecure Skill Coding Practices
Warning
- Location
- index.js:96
- Finding
- Sensitive QR Content Exposed Through URL Query Parameters## Vulnerability Details **File Location**: `index.js`, line 96 **Vulnerability Type**: Sensitive information exposure through URL query parameters **Risk Level**: Medium ### Vulnerable Code ```js const qrUrl = `${siteOrigin()}/qr-generator?text=${encodeURIComponent(content)}&size=${size}&error=${errorLevel}`; ``` The documentation explicitly presents credentials as expected QR content: ```text /lynqn qr "Wi-Fi: MyNetwork, Password: 12345" --size 400 --error H ``` ### Technical Analysis The skill inserts arbitrary user-provided QR content into the `text` query parameter of an externally hosted URL. `encodeURIComponent()` makes the value syntactically safe for a URL, but it does not encrypt, redact, or otherwise protect the content. When the returned URL is opened, its complete query string may be retained by browser history, the LYNQN server's access logs, reverse proxies, monitoring infrastructure, analytics systems, and other components that record URLs. It may also be disclosed through referrer information, depending on browser and server policies. This is security-relevant because the documented use cases explicitly encourage users to process Wi-Fi passwords. The same command could be used with access tokens, personal data, private URLs, or other secrets. ### Attack Path 1. A user invokes `/lynqn qr` with sensitive content, such as a Wi-Fi password or access token. 2. The skill embeds the complete content into the `text` query parameter of a LYNQN URL. 3. The skill returns that URL in the agent's reply. 4. The user opens the URL to generate or download the QR code. 5. The browser sends the complete query string to the external LYNQN service. 6. The sensitive value may be retained in browser history or recorded by servers, proxies, monitoring tools, or analytics systems. 7. An attacker or unauthorized operator with access to any such records may recover the original secret. ### Impact Assessment Successful exploitation does not grant local code e ...[truncated 409 chars]
- Remediation
- ## Remediation Suggestions 1. Generate QR codes locally so the QR payload never needs to be disclosed to an external service. 2. If server-side generation is required, transmit the content in the body of an HTTPS `POST` request rather than in a URL query parameter. 3. Return an opaque, short-lived identifier instead of a URL containing the original content. 4. Configure the remote service and intermediaries to avoid logging request bodies containing QR payloads, and apply strict retention and access controls. 5. Add an explicit warning that users must not submit passwords, tokens, private keys, or other secrets unless a confidential processing design is implemented. 6. Remove credential-bearing QR examples from `README.md` and replace them with non-sensitive sample content. 7. Apply an appropriate restrictive `Referrer-Policy` on the QR page as defense in depth, while recognizing that this does not prevent browser-history or server-log exposure.