Qr Campaign Studio

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:16 AM UTC
• Version: 1.0.1

Overview

This QR-code skill is mostly coherent, but it has unsafe file-writing and sensitive-data handling that users should review before installing.

Install only if you are comfortable reviewing or fixing the batch filename handling and sensitive metadata behavior. Avoid processing untrusted CSV/JSON batch files, do not put WiFi passwords in shared output directories or logs, and prefer pinned dependency versions before production use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/qr_batch.py:45

Finding

Batch Filename Path Traversal Permits Writes Outside the Output Directory

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/qr_generate.py:247

Finding

WiFi Passwords Are Exposed in Metadata and Standard Output

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

The core description mostly aligns with the code: it does generate QR codes, supports URL/text/WiFi/vCard payloads, appends UTM tracking parameters, and embeds logos. It also clearly does not implement payment settlement logic. However, the declared description claims batch output and poster composition, neither of which appears in this code chunk. The script only accepts a single output path and generates one QR at a time; there is no loop over inputs, CSV ingestion, or batch processing mechanism. Likewise, there is no poster/canvas composition feature—only named templates that adjust QR rendering parameters. Additionally, the code performs extra undeclared behavior such as contrast checking, optional verification by decoding the generated QR, and writing metadata JSON. These extras are not dangerous, but the missing declared capabilities make the description materially inaccurate.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The supplied code chunk implements only one narrow subset of the declared description: poster composition using an already-generated QR image and a background image. It does not generate QR codes, does not process payload types like text/URL/WiFi/vCard, does not create UTM tracking links, does not perform batch output, and does not embed logos into QR codes. While poster composition is mentioned in the description, the actual code's primary behavior is much narrower than the declared overall purpose, so the description does not accurately represent this code chunk on its own.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises shell, file, and network-capable workflows in command examples but does not declare any explicit tool scope or permissions boundaries. In an agent environment, this increases the chance that the skill can read/write files or invoke commands beyond user expectations, creating unnecessary attack surface and reducing policy enforceability.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script forwards potentially sensitive fields such as Wi‑Fi passwords and vCard contact details to another process via command-line arguments. While subprocess execution is part of the tool's generation workflow, this file does not provide any warning, comment, or user-facing notice that sensitive data will be handled and exposed to a child process invocation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/qr_batch.py (reported line 87)May include surrounding context.

python

cmd += ['--vcard-url', row.get('vcard_url', '')]
            cmd += ['--vcard-note', row.get('vcard_note', '')]

        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
        if p.returncode == 0:
            ok += 1
            status = 'ok'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script writes QR images and optional metadata files containing payload content or previews to disk, including potentially sensitive WiFi credentials, vCard contact data, or tracked URLs. Because there is no warning, redaction, or sensitivity-aware handling, users may inadvertently persist secrets in accessible files, logs, or shared workspaces.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 0% confidence

Finding

No reportable policy violation is present. The file includes both English and Chinese content rather than mandating a single language without user choice, so it does not violate the language/locale policy rule.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The dependency specification for Pillow is only lower-bounded (>=10.0.0), which makes builds non-reproducible and allows installation of different versions across environments. In a skill that processes QR images, logos, and poster composition, this increases exposure to dependency regressions or vulnerable releases if an affected Pillow version is resolved.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

qrcode[pil]>=7.4.2
pillow>=10.0.0

Unverifiable Dependency: pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Pillow has a history of security advisories, including resource-consumption and potential code-execution issues, and the manifest does not pin a version, so it is impossible to verify whether deployed environments avoid affected releases. Because this skill handles user-influenced image content such as embedded logos and poster assets, unsafe or inconsistent Pillow versions could increase the risk from malicious image inputs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code creates the output directory and later writes generated PNG, metadata, and optional report files, but it provides no confirmation prompt, warning message, or explanatory comment/docstring about these filesystem changes. For a code file, file writes should have some visible disclosure unless clearly documented elsewhere, which is not evident in this file.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/qr_generate.py (reported line 96)May include surrounding context.

python

if args.template and args.template in templates:
        t = templates[args.template]
        for k, v in t.items():
            if getattr(args, k) == ap_defaults[k]:
                setattr(args, k, v)

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The manifest describes a general-purpose marketing QR generator with UTM tracking, logo embedding, and batch/poster use cases. The code additionally hardcodes promotional presets for specific domains (jisuapi.com and jisuepc.com) and auto-fills campaign parameters for them, which is behavior more specific than the manifest's generic description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.