Near Qr Skill

PassAudited by ClawScan on May 1, 2026.

Overview

The skill appears to do what it claims: generate and read NEAR QR codes without requesting credentials, network access, or hidden persistence.

This skill looks safe for its stated purpose. Before installing, use a trusted Python environment, review the dependency versions if reproducibility matters, choose output paths carefully, and verify any generated payment QR code recipient and amount before sharing or scanning it.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the skill may pull newer package versions from the Python package index, which can affect reproducibility or inherit future dependency issues.

Why it was flagged

The skill relies on external Python packages with lower-bound version ranges rather than pinned exact versions. This is expected for the QR-code purpose, but dependency versions may vary between installations.

Skill content

qrcode[pil]>=7.4
Pillow>=10.0
pyzbar>=0.1.9

Recommendation

Install in a virtual environment and, for higher assurance, pin and review dependency versions before use.

Low

#ASI02: Tool Misuse and Exploitation

What this means

A poorly chosen output path could overwrite an existing file or place a QR image somewhere unintended.

Why it was flagged

Generated QR images are saved to default or user-provided paths. This is central to the skill's purpose, but the code does not show overwrite protection or path restrictions.

Skill content

output_path = output or f"{account.replace('.', '_')}_qr.png"
img.save(output_path)

Recommendation

Use explicit, safe output paths and verify the destination before generating QR files.