QR Code Generator & Reader

• Risk level: Low
• Analyzed: May 1, 2026, 5:23 AM
• Findings: 1
• Version: 1.0.0

Overview

This skill appears to perform only local QR code generation and reading, with disclosed manual dependency installs to review before use.

This looks safe for local QR generation and decoding. Before installing, verify the dependency commands are acceptable for your environment, use a virtual environment if possible, and treat any decoded QR text or URL as untrusted until you inspect it.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI04: Agentic Supply Chain Vulnerabilities

Low

What this means

Using the skill may require installing external packages on your machine, so your trust extends to those package sources as well as the skill files.

Why it was flagged

The skill relies on user-installed third-party Python packages and system libraries. This is expected for QR generation/reading, but the packages are unpinned and installed outside the registry install spec.

Skill content

pip install qrcode pillow ... pip install pillow pyzbar ... On macOS: `brew install zbar` ... On Linux: `apt install libzbar0`

Recommendation

Install dependencies only from trusted package managers, preferably in a virtual environment, and consider pinning versions if reproducibility matters.