ClawHub
Back to skill

Security audit

QRdex

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward QRdex.io API helper; it uses an API key, sends QR data to QRdex, and can update or soft-delete QR codes when the user invokes those actions.

Install only if you trust QRdex.io with the QR data you provide and the QRDEX_API_KEY available to the agent. Confirm before asking an agent to delete QR codes, and set track_scans deliberately when scan analytics are not desired.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Tool Parameter Abuse

High
Category
Tool Misuse
Content
Same body params as Create, all optional. Only provided fields are updated.

### DELETE /qr_codes/:id — Soft Delete

Returns `{"data": {"id": 123, "deleted": true}}`.
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill documents use of environment variables and outbound network access but does not declare any explicit tool scope or permissions boundary. That omission can cause an agent runtime to invoke capabilities broader than the user expects, increasing the chance of unintended API calls or secret access.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill description advertises destructive deletion and scan-tracking features without warning that these actions can remove resources or process tracking data. In an agent setting, lack of up-front disclosure raises the risk of accidental data-impacting operations and privacy-sensitive behavior being triggered without meaningful user confirmation.

External Transmission

Medium
Category
Data Exfiltration
Content
### Create a QR Code

```bash
curl -X POST https://qrdex.io/api/v1/qr_codes \
  -H "Authorization: Bearer $QRDEX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
### List QR Codes

```bash
curl https://qrdex.io/api/v1/qr_codes \
  -H "Authorization: Bearer $QRDEX_API_KEY"
```
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The documentation states that `track_scans` defaults to `true` but does not prominently warn users that QR code creation will enable scan tracking unless they explicitly opt out. In a skill that creates and manages QR codes, this can lead to unintentional collection of scan analytics and associated privacy/compliance issues, especially if users assume non-tracking behavior by default.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The delete command performs an irreversible remote deletion immediately, with no confirmation, dry-run mode, or warning. In a skill that manages QR resources over an authenticated API, this increases the chance of accidental or induced destructive actions that remove user assets and tracking data.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
def api(method, path, **kwargs):
    r = getattr(requests, method)(f"{BASE}{path}", headers=headers(), **kwargs)
    if r.status_code == 204:
        return {}
    if r.headers.get("content-type", "").startswith("image/"):
Confidence
50% confidence
Finding
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Missing User Warnings

Low
Confidence
84% confidence
Finding
The image command writes server-supplied content to a local file path without any pre-action disclosure or confirmation, and the output path can overwrite an existing file if the operator supplies one. In an agent or automation context, silent filesystem writes are security-relevant because they can cause unintended local state changes or clobber user files.

Static analysis

No suspicious patterns detected.