QR Code Generator

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:52 PM UTC
• Version: 1.0.0

Overview

The skill does what it claims, but its QR-generation command template handles user text unsafely and could let crafted input run unintended commands.

Install only if you trust the environment and update the skill before use: pass QR text and output paths as arguments to a script, validate the destination path and .png extension, avoid overwriting existing files unless confirmed, and pin or review the qrcode[pil] dependency before installation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:22

Finding

Command Injection Through Unsafe User Input Interpolation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22-31
Vulnerability Type: Command injection through dynamically constructed Python and shell code
Risk Level: High

Vulnerable Code:

markdown

## Execution Instructions
When the user requests a QR code, execute a Python one-liner to perform the generation. 

### Implementation Template:
```bash
python3 -c "import qrcode; img = qrcode.QRCode(version=1, box_size=10, border=5); img.add_data('USER_TEXT_HERE'); img.make(fit=True); img.make_image(fill_color='black', back_color='white').save('FILE_NAME.png')"

text

### Technical Analysis

The implementation template places user-controlled QR content and the requested output filename directly inside Python string literals embedded in a shell command. No escaping, parameterization, or validation is specified.

An attacker can provide input containing quote characters and Python syntax that terminates the intended string and introduces additional statements. For example, QR content shaped like:

```text
'); __import__('os').system('ATTACKER_COMMAND'); #

can transform the generated one-liner so that os.system() is evaluated when the agent executes python3 -c. A filename containing shell metacharacters or double quotes could also escape the outer shell quoting if interpolated verbatim.

This flaw is conditional on the agent following the documented placeholder-substitution approach, but that is the explicit implementation mechanism supplied by the skill.

Attack Path

1. An attacker asks the agent to generate a QR code using maliciously crafted text or a crafted output filename.
2. The agent replaces USER_TEXT_HERE or FILE_NAME.png in the documented command with the supplied value.
3. The crafted value terminates the intended Python string or outer shell context.
4. The agent invokes the resulting python3 -c command.
5. The injected Python or shell command executes with the s ...[truncated 586 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the dynamically constructed one-liner with a fixed Python script.

• Pass QR content and output paths as ordinary process arguments or through standard input rather than embedding them in Python source code.

• Invoke Python through a structured process API without a shell, such as an argument array equivalent to:

  text

  ["python3", "generate_qr.py", "--text", user_text, "--output", validated_path]
  

• Parse arguments with argparse and treat all supplied content strictly as data.

• Restrict output to an approved workspace directory.

• Resolve and normalize the destination path before writing, reject traversal outside the approved directory, and enforce an expected .png extension.

• Define overwrite behavior explicitly and reject symbolic-link destinations where appropriate.

• Add tests covering single quotes, double quotes, semicolons, command substitutions, newlines, path traversal sequences, and absolute paths.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8

Finding

Automatic Installation of Unpinned Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8-18; README.md, lines 12-16
Vulnerability Type: Unpinned and unverified dependency installation
Risk Level: Medium

Vulnerable Code from SKILL.md:

yaml

metadata:
  openclaw:
    requires:
      bins:
        - python3
      pip:
        - qrcode[pil]

markdown

- **Error Handling:** If `qrcode` is missing, the agent should first attempt `pip install qrcode[pil]`.

Related Installation Reference from README.md:

markdown

## 🚀 Installation

Install directly via **ClawHub**:

```bash
clawhub install your-github-username/qr-generator

Technical Analysis

The Python dependency is identified only as qrcode[pil], with no exact version, lock file, package hash, or approved index. Consequently, installation can resolve to different artifacts over time. The instruction also directs the agent to initiate installation automatically when the module is unavailable.

If the configured package index, package-maintainer account, dependency resolution path, or downloaded artifact is compromised, the agent could retrieve a malicious release. Installation from a source distribution may execute attacker-controlled build code, while a malicious installed package could execute when imported by the QR-generation command.

The README additionally uses the placeholder package reference your-github-username/qr-generator rather than a verified canonical publisher path. This creates ambiguity about the intended installation source and could lead users to an unintended package if the placeholder is copied or replaced incorrectly.

Attack Path

1. The target environment does not already contain the required qrcode dependency.
2. Following the skill instructions, the agent runs pip install qrcode[pil] without a pinned version or hash.
3. Dependency resolution uses the environment's configured package index and s ...[truncated 987 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency and relevant transitive dependencies to reviewed versions.
• Store dependencies in a lock file and verify package artifacts with cryptographic hashes, such as installation with --require-hashes.
• Use an explicitly approved package index and disable unintended extra-index resolution.
• Prefer a prebuilt, reviewed environment instead of installing packages automatically during skill execution.
• Require user confirmation before modifying the Python environment.
• Install into an isolated virtual environment with minimal permissions rather than a global or privileged environment.
• Review version updates before changing lock files or accepted hashes.
• Replace your-github-username/qr-generator with the verified canonical ClawHub publisher and package identifier.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The markdown states that the skill saves output directly to the workspace as a .png file, which affects user data/storage, but it does not include any caution about creating files, choosing output locations, or potential overwrites. For markdown files, the criteria call for warning users about behaviors that could affect user data or system state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file states that the skill will generate and save QR code images locally and defaults to writing qrcode.png in the current working directory. Because file creation can affect user data or workspace state, the description should explicitly warn users that running the skill writes a local file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The implementation template instructs the agent to execute a command that saves an image file, but the markdown does not provide a user warning adjacent to the command about this write operation. For markdown skills, behaviors that modify the filesystem should be clearly disclosed so users understand the effect before invocation.

Content

No source excerpt is available for this finding.