二维码生成skill

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 12:28 AM UTC
• Version: 1.0.1

Overview

This skill is a straightforward QR code generator that runs a local script and writes a user-requested image file, with some documentation and dependency-safety caveats.

Install only if you are comfortable with a skill that runs a bundled Python script to create PNG files. Choose output paths deliberately to avoid overwriting files, and prefer installing its qrcode dependency through a pinned or trusted environment rather than following ad hoc pip guidance.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: agent.py:9

Finding

Unpinned Third-Party Dependency Installation Guidance

Content

View full analysis

Vulnerability Details

File Location: agent.py, lines 9–13
Vulnerability Type: Unpinned and unverified third-party dependency
Risk Level: Medium

python

try:
    import qrcode
except ImportError:
    print("Error: qrcode library not installed", file=sys.stderr)
    print("Install with: pip install qrcode[pil]", file=sys.stderr)
    sys.exit(1)

Technical Analysis

When the qrcode module is unavailable, the script instructs the user to install qrcode[pil] without specifying a reviewed version, cryptographic hashes, or a trusted package index. Package resolution therefore depends on mutable metadata and artifacts supplied by the active pip index and the user's local pip configuration.

This guidance also conflicts with SKILL.md line 29, which explicitly instructs users not to install libraries themselves. Although the script does not automatically execute pip, its prescribed recovery action exposes users who follow it to supply-chain risk. A compromised package release, package index, dependency, or configured mirror could introduce arbitrary code during installation or subsequent import.

Attack Path

1. The user invokes the skill in an environment where qrcode is not installed.
2. The import fails, and the script displays pip install qrcode[pil].
3. The user follows the displayed instruction.
4. pip resolves an unpinned version and its transitive dependencies from the configured package index or mirror.
5. If that source or a resolved artifact has been compromised or substituted, attacker-controlled code executes during installation or when qrcode is later imported.
6. The malicious code runs with the privileges of the user or environment performing the installation or invocation.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the installing user's privileges. The resulting scope may include access to that user's files, environment ...[truncated 374 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the ad hoc pip install qrcode[pil] instruction from runtime error output.
• Declare qrcode[pil] in a reviewed dependency manifest or lockfile using an exact approved version.
• Require cryptographic hashes for all direct and transitive packages, such as through a hash-locked requirements file and pip install --require-hashes.
• Install packages only from an approved, authenticated package repository or controlled internal mirror.
• Integrate dependency vulnerability and integrity scanning into the release process.
• Document a controlled installation workflow consistent with the prohibition in SKILL.md against users installing dependencies themselves.
• Run the skill in an isolated, least-privileged environment so a compromised dependency cannot access unrelated user or system resources.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The description does not describe the script’s functional purpose at all; instead it gives an implementation instruction ('call the existing Python script, do not write your own code'). The actual code chunk is a complete QR code generator that accepts CLI input, creates QR images, and writes them to a specified file path. This is a materially different primary purpose from the declared description, and the file-writing behavior is also undeclared. Therefore this is a clear description/behavior mismatch.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: generate-qrcode
description: "MANDATORY: Call the existing Python script. DO NOT write your own code."
metadata: { "openclaw": { "emoji": "📱", "always": true } }
---

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The always: true metadata allows the skill to activate without narrow trigger constraints, increasing the chance it is invoked in unrelated contexts. Because the skill writes files and executes a local script, broad auto-activation expands the attack surface and can lead to unintended file creation or command execution flows.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest description says 'MANDATORY: Call the existing Python script. DO NOT write your own code,' which constrains the skill to invoking preexisting functionality rather than reimplementing it. This file contains the full QR-code generation implementation itself, including library usage, directory creation, and file output, so the actual behavior does not match the stated implementation intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill examples show writing image output to the filesystem, but the description does not clearly warn users that local files will be created. This can cause unintended persistence of data, confusion about where outputs are stored, and accidental overwriting of existing files if the output path is not carefully chosen.

Content

No source excerpt is available for this finding.