QR Code Generator

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 11:26 PM UTC
• Version: 1.0.0

Overview

This skill locally generates QR code PNGs and has no hidden network, persistence, or destructive behavior, but users should treat WiFi QR outputs as sensitive.

Install dependencies in a virtual environment where possible, avoid running package installation with sudo unless you trust the OS repository, and treat WiFi QR PNGs as secrets because they contain the network password and may remain in shell history, terminal logs, or saved files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20
• Finding: Unpinned Third-Party Dependencies Create Supply-Chain Exposure## Vulnerability Details **File Location**: `SKILL.md`, lines 20-25 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash pip3 install qrcode[pil] # or on Ubuntu/Debian: sudo apt-get install python3-qrcode ``` ### Technical Analysis The installation instructions retrieve `qrcode`, its Pillow dependency, or the distribution package without specifying reviewed versions or integrity hashes. Consequently, the code installed by users can change independently of the reviewed Skill. The package names do not appear to be typographical imitations, and the project does not intentionally retrieve a remote executable payload. The risk instead arises from unconstrained dependency resolution: a compromised package-index account, malicious dependency release, compromised repository, or incompatible future release could introduce unexpected code during installation or import. Because Python packages can execute code during installation and later when imported, dependency compromise could affect both the installation process and every execution of the QR generator. ### Attack Path 1. An attacker compromises an upstream package, maintainer account, package repository, or dependency release. 2. The attacker publishes a malicious version that still satisfies the unconstrained installation command. 3. A user follows the documented `pip3 install qrcode[pil]` instruction. 4. The package manager resolves and installs the attacker-controlled release. 5. Malicious code executes during installation or when `qrcode` or `PIL` is imported by `scripts/qr-code.py`. This path requires compromise or malicious modification of an upstream dependency or package source; the audited project itself does not contain such a payload. ### Impact Assessment Malicious dependency code could operate with the permissions of the user running `pip3` or the QR generator. Potential impact includ ...[truncated 488 chars]
• Remediation: ## Remediation Suggestions 1. Add a reviewed dependency manifest with exact versions for `qrcode`, Pillow, and all transitive dependencies. 2. Generate and verify cryptographic hashes, for example with a locked requirements file and: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Periodically update pinned versions through a controlled review process that includes vulnerability and provenance checks. 4. Recommend installation in a dedicated virtual environment rather than a global or privileged Python environment. 5. Avoid running `pip` as root and document trusted operating-system repositories when suggesting distribution packages. 6. Consider publishing a reproducible lock file generated by a dependency-management tool such as `pip-tools`.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/qr-code.py:125
• Finding: Sensitive WiFi Credentials and Personal Data Are Accepted Through Process Arguments## Vulnerability Details **File Location**: `scripts/qr-code.py`, lines 125-151 **Vulnerability Type**: Plaintext sensitive data exposure through command-line arguments **Risk Level**: Low ### Vulnerable Code ```python ssid = sys.argv[2] password = sys.argv[3] output = sys.argv[4] if len(sys.argv) > 4 else None wifi_string = generate_wifi_qr(ssid, password) result = generate_qr(wifi_string, output) if result: print(f"✅ WiFi 二维码已生成: {result}") print(f"SSID: {ssid}") print("手机扫描即可自动连接WiFi") else: print("❌ 生成失败") return 1 elif command == "vcard": # 解析参数 import argparse parser = argparse.ArgumentParser(description='生成名片二维码', prog='qr-code vcard') parser.add_argument('--name', '-n', required=True, help='姓名') parser.add_argument('--phone', '-p', help='电话') parser.add_argument('--email', '-e', help='邮箱') parser.add_argument('--org', '-o', help='公司/组织') parser.add_argument('--title', '-t', help='职位') parser.add_argument('--url', '-u', help='网址') ``` ### Technical Analysis The WiFi command obtains the network password directly from `sys.argv`. The vCard command similarly accepts names, phone numbers, email addresses, organizations, titles, and URLs as command-line options. Command-line arguments may be retained in shell history and may be captured by terminal logging, process telemetry, audit systems, job runners, or wrapper scripts. Depending on the operating system and process-inspection restrictions, arguments may also be visible to other local users while the process is running. The script does not pass these values to a shell and therefore this is not command injection. It also does not transmit the data over a network. The weakness is local plaintext exposure caused by the input channel. ### Attack Path 1. A user invokes the documented WiFi command with a plaintext password, such as `qr-code wifi "SSID" "password"`. 2. The shell ...[truncated 1099 chars]
• Remediation: ## Remediation Suggestions 1. Read WiFi passwords interactively with `getpass.getpass()` so they are neither echoed nor included in the process argument vector: ```python from getpass import getpass password = getpass("WiFi password: ") ``` 2. Make the password argument optional and prompt securely when it is omitted. 3. Support input through standard input or a permission-restricted configuration file for automated use. 4. Clearly warn users that command-line secrets can be retained in shell history and process telemetry. 5. For sensitive vCard fields, offer interactive or protected-file input in addition to command-line options. 6. Avoid printing sensitive values in status messages, logs, or exception details. 7. Ensure generated QR image files containing credentials are created with restrictive permissions and stored only in user-approved locations.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The manifest description says to use the skill for "any QR code generation needs," which is a broad activation condition without clear constraints or exclusion cases. This can overlap with many general requests involving QR codes and does not define when the skill should or should not be invoked.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
pip3 install qrcode[pil]
# or on Ubuntu/Debian:
sudo apt-get install python3-qrcode
```

## Quick Start

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The WiFi QR feature encodes the SSID and password into a portable image, but the documentation does not warn users that sharing or storing that PNG exposes valid network credentials. This can lead to accidental credential disclosure, especially because the skill encourages easy sharing and custom output paths without highlighting the sensitivity of the resulting file.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

print("  pip3 install qrcode[pil]")
        print("")
        print("或:")
        print("  sudo apt-get install python3-qrcode")
        return 1

    command = sys.argv[1]

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The WiFi command generates a QR code containing the network SSID and password, then saves it to disk without any explicit warning that sensitive credentials will persist locally, potentially at a predictable default path. In this skill context, the feature is legitimate, but it increases exposure because users may unintentionally leave shareable WiFi secrets in accessible files or screenshots.

Natural-Language Policy Violations

Low

• Confidence: 97% confidence
• Finding: The file's docstring and all CLI help and status messages are written in Chinese, which forces a specific language on users without offering a locale or language selection. This is a natural-language policy concern because the skill does not document that it is region-specific or provide an opt-in language choice.

Static analysis

No suspicious patterns detected.