qr-code-toolkit

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:19 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent QR utility, but it can expose WiFi passwords in command output and saved files, and a filename bug can write QR images outside the intended folder.

Review before installing if you will generate WiFi or contact QR codes. Treat generated PNGs as sensitive, avoid using real passwords in shell commands where possible, store outputs in a controlled folder, delete them when done, and be aware that this version can print WiFi passwords to logs and may not reliably confine WiFi QR filenames to its default output directory.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/qr.sh:69

Finding

WiFi SSID Path Traversal Can Write QR Images Outside the Intended Directory

Content

View full analysis

`, to already exist. This limits but does not eliminate the vulnerability. The destination also has a timestamp and `.png` suffix, restricting which filenames can be targeted. Nevertheless, the script does not enforce its intended output-directory boundary. ### Attack Path 1. An attacker identifies or creates a suitable directory under `$QR_DIR` whose name begins with `wifi_`. 2. The attacker supplies an SSID containing a normal first component followed by `/../` traversal sequences and an external destination path. 3. The script concatenates the SSID into: `"$QR_DIR/wifi_${ssid}_.png"`. 4. Filesystem path resolution processes the embedded traversal components. 5. `qrencode -o` creates or overwrites the resolved PNG destination outside `$QR_DIR`, provided the necessary parent directories exist and the process has write permission. ### Impact Assessment The att ...[truncated 441 chars]

Remediation

View remediation

&2 return 1 ;; esac ``` Using a fully opaque filename independent of the SSID is preferable. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/qr.sh:42

Finding

WiFi Password Is Disclosed in Command Output

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 27)May include surrounding context.

Linux:

bash

sudo apt-get install qrencode zbar-tools

Usage

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README demonstrates passing a WiFi password directly as a shell argument, which can expose sensitive credentials through shell history, process listings, terminal logs, and copied example commands. In a QR-generation skill, this is contextually relevant because users are likely to use real network credentials and may also persist the generated QR image, further increasing accidental disclosure risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly supports generating WiFi and vCard QR codes that can encode passwords, phone numbers, and email addresses, and it states that QR codes are saved to disk by default. Without any warning about sensitive data exposure or storage hygiene, users may unintentionally persist secrets in image files that can be copied, synced, or shared. In this context, the omission is meaningful because the tool is designed to handle credential and contact data, making accidental disclosure more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The WiFi QR feature encodes SSID and password into a PNG file and then calls generate_qr, which prints the full QR content to stdout. That can expose credentials in terminal logs, agent transcripts, or other observability systems, and the generated image also persists the secret on disk without any warning or consent flow. In a QR utility skill, handling secrets is expected, but echoing and persisting them by default increases the risk of unintended disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The batch mode reads arbitrary lines from an input file and writes a corresponding PNG for each one, but there is no warning or descriptive comment explaining that potentially sensitive input data will be converted into durable files. For a bulk operation, users may not realize that all entries are being materialized to disk in the output directory.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.