Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
二维码生成器
v3.0.0Generate QR codes from text, URLs, or images. Use when users ask to 'generate QR code', 'create QR', or 'make QR code for'. Supports text content, URLs, and...
⭐ 0· 568·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (QR code generation) matches the files and declared requirements: the skill only depends on qrcode and Pillow, reads specified local image paths, and writes QR images to the temp directory. There are no unexpected environment variables, binaries, or config paths requested.
Instruction Scope
SKILL.md and agent.py restrict file access to supplied image paths and temp dir, and the code returns an image path. Minor note: the implementation embeds local images as base64 data URLs into the QR payload when small enough, which can produce very dense/unscannable QR codes; SKILL.md mentions preferring URLs but does not enforce or warn about scannability. Also the SKILL.md prints full source — that's transparent but not a security issue.
Install Mechanism
No custom install spec; dependencies are standard Python packages (qrcode[pil], Pillow) listed in requirements.txt and suggested pip install in SKILL.md. No downloads from arbitrary URLs or archive extraction.
Credentials
The skill requests no environment variables or credentials. It legitimately reads local image files (as declared) and writes to the system temp directory; that access is proportional to its purpose. Users should be aware that any local file path they pass will be read.
Persistence & Privilege
always is false, no special persistence or system-wide config changes are requested, and the skill does not modify other skills or system settings.
Assessment
This skill appears to do exactly what it says. Before installing or invoking it: (1) only provide image file paths you trust (the skill will read the file and may embed it in the QR), (2) be aware embedding whole images as base64 often creates very dense or unscannable QR codes—use an image URL when possible, (3) install the listed Python packages in a virtualenv to avoid system-wide package changes, and (4) review/scan the included agent.py if you require extra assurance (it currently performs only local file reading, base64 encoding, and writing to the temp directory).Like a lobster shell, security has layers — review code before you run it.
latestvk978jbe6ye8qrp91ezkf4estkx81habn
License
MIT-0
Free to use, modify, and redistribute. No attribution required.