Security audit

Qrcode Skill

Security checks for vulnerabilities and agentic risk

Overview

This QR-code skill is purpose-aligned and clearly says it uses a remote MCP service, but users should avoid sending sensitive QR contents unless they accept that data transfer.

Install only if you are comfortable sending QR text or QR images to the listed remote service. Do not use it for passwords, OTP setup codes, private tickets, payment data, access tokens, or confidential business data unless that transfer is acceptable.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

Location: SKILL.md:39
Finding: Potential Disclosure of Sensitive QR Content to a Third-Party Service
Content: View full analysis
)` 6. If the user wants to save it, write the decoded base64 data to a `.png` file ### Decode a QR Code 1. Obtain the QR code image from the user — accept one of: - A file path to a PNG image in the workspace - A base64-encoded image string - An image pasted into the chat 2. If a file path is provided, read it and convert to base64 3. Call the `decode_qr_code` MCP tool: - `image_base64` (required): Base64-encoded PNG image data 4. Return the decoded text to the user ``` The included usage example explicitly demonstrates processing a credential: ```markdown **Generate:** > "Generate a QR code for https://github.com" > "Create a 256px QR code containing my WiFi config: WIFI:T:WPA;S:MyNetwork;P:password123;;" ``` The API reference confirms that this data is transmitted to a remote endpoint: ```text URL: https://qrcode.api4claw.com/mcp Protocol: MCP (Model Context Protocol) over HTTP Protocol Version: 2024-11-05 ``` ```markdown | `text` | string | Yes | Text to encode into QR code (max 1000 characters) | ``` ```markdown | `image_base64` | string | Yes | Base64-encoded PNG ...[truncated 2757 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs sending user-provided text and QR image data to a third-party remote MCP endpoint, but it does not require a clear user warning or consent step before external transmission. This is dangerous because QR contents can include sensitive data such as login URLs, Wi‑Fi credentials, tickets, personal identifiers, or embedded secrets, and users may reasonably assume local processing unless told otherwise.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The API reference explicitly documents sending user-provided text and base64-encoded images to an external MCP endpoint, but gives no notice that this data leaves the local environment or may be processed by a third party. In a QR skill, users may submit sensitive URLs, tokens, contact data, or images containing embedded secrets, so the lack of transparency and consent creates a real privacy and data-handling risk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.