Caoliao Qrcode Markdown Content

• Outcome: Pass
• Latest audit: May 28, 2026 at 11:23 AM UTC
• Version:
  0.1.0

Overview

This skill narrowly fetches Markdown from validated qr61.cn QR links and shows no hidden local access, persistence, or destructive behavior.

Install this only if you want your agent to contact qr61.cn links and retrieve their Markdown content. The remote site or redirect target may see request metadata such as IP address and headers, and any fetched Markdown should be reviewed as untrusted content before acting on links or instructions inside it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The README states the skill will automatically fetch content from user-provided external QR short links, but does not disclose that this triggers outbound network access or mention privacy implications. This can surprise users, leak metadata such as IP/request headers to the remote site, and encourage unsafe retrieval from untrusted links without informed consent.

VirusTotal

65/65 vendors flagged this skill as clean.