Near Qr Skill

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:53 PM UTC
• Version: 1.0.0

Overview

This skill is a local QR-code utility for NEAR addresses and payment requests, with ordinary dependency and publishing-tool supply-chain cautions but no hidden data access or automatic high-impact actions.

Install dependencies in a virtual environment, avoid running the publishing command unless you trust and pin the MoltHub package version, and only decode QR images from sources you trust because image parsers can have vulnerabilities. Review generated payment QR details before sharing or using them, since the skill encodes payment requests but does not verify recipient intent or submit transactions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:41
• Finding: Mutable npm Package Is Downloaded and Executed Through npx<![CDATA[ ## Vulnerability Details **File Location**: `README.md:41-44` **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium ### Vulnerable Code ```markdown ## Publishing to MoltHub ```bash npx molthub@latest publish ``` ``` ### Technical Analysis The documented publishing command instructs users to execute the mutable `latest` release of the `molthub` npm package. When the command is run without an already trusted local installation, `npx` may download the package and execute its entry point. The effective code can therefore change after this Skill has been reviewed. The command is related to publishing rather than ordinary QR generation or decoding, and there is no evidence that the Skill invokes it automatically. Nevertheless, a user following the documented workflow would execute supply-chain code that is not pinned to a reviewed version or integrity value. ### Attack Path 1. An attacker compromises the upstream `molthub` package, its maintainer account, or the package publication process. 2. The attacker publishes a malicious release and assigns or causes it to receive the `latest` distribution tag. 3. A user follows the README and runs `npx molthub@latest publish`. 4. `npx` retrieves and executes the mutable package release. 5. The malicious package executes with the privileges and environment of the user running the command. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the publishing user's privileges. Depending on the user's environment, exposed resources could include source code, repository credentials, npm authentication tokens, environment variables, and files accessible to that account. No privilege escalation beyond the invoking user's existing permissions is demonstrated by the project. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace `@latest` with an explicitly reviewed version, for example `npx molthub@<reviewed-version> publish`. - Prefer installing the publishing tool from a lockfile with integrity metadata and invoking that locked local installation. - Use `npx --no-install` where practical to prevent an invocation from silently downloading an absent package. - Review the selected package release, its transitive dependencies, and lifecycle scripts before use. - Keep publishing tooling separate from the runtime installation instructions so users do not mistake it for a required operational dependency. - Run publishing tools in a restricted environment with only the minimum credentials and filesystem access needed for publication. ]]>

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1
• Finding: Python Dependencies Are Not Reproducibly Pinned<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:1-3` **Vulnerability Type**: Unbounded third-party dependency resolution **Risk Level**: Low ### Vulnerable Code ```text qrcode[pil]>=7.4 Pillow>=10.0 pyzbar>=0.1.9 ``` ### Technical Analysis All Python dependencies use lower-bound-only constraints. A future installation may therefore resolve to releases that did not exist when the project was audited. The file also lacks package hashes, so it does not establish artifact integrity or a reproducible reviewed dependency set. These package names appear to be normal PyPI dependencies, and the audit found no evidence of dependency confusion, typosquatting, a malicious package, or an unsafe package index. The risk is conditional on a future upstream compromise, malicious release, or incompatible vulnerable version being selected. ### Attack Path 1. An upstream dependency project or package-publishing account is compromised, or a malicious future release is published under a permitted version. 2. A user runs `pip install -r requirements.txt`. 3. The resolver selects the compromised release because every version at or above the stated minimum is allowed. 4. Malicious installation or runtime code executes when the dependency is installed, imported, or used by `near_qr.py`. 5. The code runs with the permissions of the Python installation or application user. ### Impact Assessment A compromised dependency could execute arbitrary code with the installing or runtime user's privileges. This could expose files, environment variables, source code, or credentials accessible to that account. The project itself does not grant elevated privileges, create persistence, or transmit data, so the practical scope remains limited to the invoking user's permissions unless the dependency is installed by a privileged account. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin each direct and transitive dependency to a reviewed exact version through a generated lockfile. - Require cryptographic hashes for downloaded artifacts, such as by using `pip-compile --generate-hashes` and installing with `pip --require-hashes`. - Update dependencies through a controlled review process rather than allowing installations to select arbitrary future releases. - Run vulnerability and provenance checks against the resolved dependency set in continuous integration. - Install dependencies in an isolated virtual environment as an unprivileged user. - Document and pin the required native `zbar` package where reproducible deployment is required. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```

> **Note:** Reading QR codes requires `zbar` system library.  
> macOS: `brew install zbar` · Ubuntu: `sudo apt install libzbar0`

## Quick Start

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The README instructs users to run `npx molthub@latest publish`, which fetches and executes the latest package version at runtime without pinning. If the package is compromised or a malicious update is published, users could execute attacker-controlled code on their machine during publishing.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

qrcode[pil]>=7.4
Pillow>=10.0
pyzbar>=0.1.9

• Confidence: 97% confidence
• Finding: The dependency is specified with a lower-bound only (Pillow>=10.0), which allows any future release to be installed. This weakens build reproducibility and can unexpectedly pull in a vulnerable or breaking version, especially significant here because Pillow processes image data and has a history of security advisories.

Unverifiable Dependency: Pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 92% confidence
• Finding: Pillow has multiple published security advisories, and because the manifest does not pin a version, there is no way to verify whether installation will select a fixed or vulnerable release. In this skill's context, that matters more than usual because Pillow is used for QR/image generation and likely image handling, an attack surface historically associated with parsing bugs, resource exhaustion, and in some versions potentially code execution.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

qrcode[pil]>=7.4
Pillow>=10.0
pyzbar>=0.1.9

• Confidence: 95% confidence
• Finding: The pyzbar dependency is also unpinned and may resolve to different versions over time, making builds non-reproducible and increasing supply-chain risk. Because this skill reads QR codes from images, a vulnerable parser/library version could expose consumers to malformed-image handling issues or dependency-level compromise.

Static analysis

No suspicious patterns detected.