QRdex

Create, manage, and track QR codes using the QRdex.io REST API. Use when working with QR code generation, URL shortening with QR codes, WiFi QR codes, email/SMS/WhatsApp QR codes, scan tracking, or any QRdex.io operations. Supports all QR types (url, email, telephone, sms, whatsapp, wifi) with customizable colors and shapes.

Security Scan

The skill's instructions and bundled script appear to match the described QRdex API use, but registry metadata omits the API key requirement and there is no homepage/source verification — this mismatch and lack of provenance merit caution before installing.

Purpose & Capability

The SKILL.md and scripts/qrdex_api.py are consistent with a QRdex.io integration (creating/listing/updating/deleting QR codes). However, the registry metadata did not declare the primary credential (QRDEX_API_KEY) even though the instructions explicitly require it — that omission is inconsistent and should be corrected.

Instruction Scope

The runtime instructions stick to interacting with the QRdex API (curl examples and a Python CLI). They do not request unrelated system files, other credentials, or external endpoints beyond qrdex.io. Error handling and rate-limit guidance are specific to the API.

Install Mechanism

This is an instruction-only skill with a bundled Python script and no install spec. That is workable, but there's no declared dependency list or install steps (e.g., Python package requirements). The absence of an install spec is a minor coherence issue — reviewers should inspect scripts/qrdex_api.py for runtime imports (requests, etc.) and confirm dependencies.

Credentials

SKILL.md requires an API key via the QRDEX_API_KEY environment variable, which is proportionate to the stated purpose. But the skill's registry metadata does not list any required env vars or primary credential — this mismatch is concerning because it hides the fact that a secret (API key) is needed and will be used by the skill.

Persistence & Privilege

The skill does not set always:true and does not declare disableModelInvocation, so it is model-invocable by default. That is typical for integration skills, but combined with the API key usage it means the model could call the QRdex API autonomously if allowed — the user should be aware that the skill can perform create/update/delete operations against the account tied to the API key.

What to consider before installing

This skill appears to implement the advertised QRdex API features, but proceed cautiously: (1) The SKILL.md requires QRDEX_API_KEY, yet the registry metadata does not declare any required credentials — treat that as a red flag and avoid providing keys until you verify. (2) There's a bundled Python script (scripts/qrdex_api.py) but no install/dependency spec; review that file to confirm it only talks to qrdex.io and does not exfiltrate data to other hosts. (3) The skill source/homepage is unknown — prefer skills with a verifiable homepage or repo. (4) If you install, use a scoped API key with minimal permissions and consider disabling autonomous model invocation (or require explicit user confirmation) if you do not want the model to create/update/delete QR codes on its own.

Manage QR codes via the QRdex.io REST API.

Setup

Set the API key as an environment variable:

export QRDEX_API_KEY="your-api-key"

Get a key from: QRdex.io → Team Settings → API section. API access requires Growth plan or above.

Quick Reference

Base URL: https://qrdex.io/api/v1

All requests require Authorization: Bearer $QRDEX_API_KEY and Content-Type: application/json.

Create a QR Code

curl -X POST https://qrdex.io/api/v1/qr_codes \
  -H "Authorization: Bearer $QRDEX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "qr_code": {
      "title": "My Website",
      "qr_type": "url",
      "url": "https://example.com"
    }
  }'

QR Types and Required Fields

Type	Required Fields
url	url
email	email_address (optional: email_subject, message)
telephone	telephone_number
sms	telephone_number (optional: message)
whatsapp	telephone_number (optional: message)
wifi	wifi_ssid (optional: wifi_encryption, wifi_password, wifi_hidden)

Common Optional Fields

• foreground_color — hex color (default: #000000)
• background_color — hex color (default: #FFFFFF)
• shape — QR code shape (default: rounded)
• track_scans — enable scan tracking (default: true)

List QR Codes

curl https://qrdex.io/api/v1/qr_codes \
  -H "Authorization: Bearer $QRDEX_API_KEY"

Query params: page, per_page (max 100), qr_type filter.

Get / Update / Delete

# Get
curl https://qrdex.io/api/v1/qr_codes/:id -H "Authorization: Bearer $QRDEX_API_KEY"

# Update (partial — only send changed fields)
curl -X PATCH https://qrdex.io/api/v1/qr_codes/:id \
  -H "Authorization: Bearer $QRDEX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"qr_code": {"title": "New Title"}}'

# Delete (soft-delete)
curl -X DELETE https://qrdex.io/api/v1/qr_codes/:id -H "Authorization: Bearer $QRDEX_API_KEY"

Download QR Image (SVG)

curl https://qrdex.io/api/v1/qr_codes/:id/image \
  -H "Authorization: Bearer $QRDEX_API_KEY" -o qr.svg

Returns image/svg+xml. Use the image_url field from any QR code response directly in <img> tags.

Using the Python Script

For programmatic use, use scripts/qrdex_api.py:

# Set API key
export QRDEX_API_KEY="your-key"

# List QR codes
python scripts/qrdex_api.py list

# Create QR codes
python scripts/qrdex_api.py create --title "My Site" --type url --url "https://example.com"
python scripts/qrdex_api.py create --title "WiFi" --type wifi --ssid "Guest" --wifi-password "pass123"
python scripts/qrdex_api.py create --title "Email" --type email --email "[e-mail]"
python scripts/qrdex_api.py create --title "Chat" --type whatsapp --phone "[phone]" --message "Hello!"

# Get details
python scripts/qrdex_api.py get 123

# Update
python scripts/qrdex_api.py update 123 --title "Updated Title" --fg-color "#FF0000"

# Delete
python scripts/qrdex_api.py delete 123

# Download image
python scripts/qrdex_api.py image 123 -o qr.svg

Error Handling

• 401 — Invalid/missing API key
• 403 — No permission
• 404 — QR code not found or belongs to different team
• 422 — Validation error or plan limit reached
• 429 — Rate limited (100 req/min per key). Check X-RateLimit-Remaining header.

API Reference

For full field descriptions and response schemas, see references/API_REFERENCE.md.