qr-code-toolkit

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:19 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent QR utility, but it can expose WiFi passwords in command output and saved files, and a filename bug can write QR images outside the intended folder.

Review before installing if you will generate WiFi or contact QR codes. Treat generated PNGs as sensitive, avoid using real passwords in shell commands where possible, store outputs in a controlled folder, delete them when done, and be aware that this version can print WiFi passwords to logs and may not reliably confine WiFi QR filenames to its default output directory.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/qr.sh:69
• Finding: WiFi SSID Path Traversal Can Write QR Images Outside the Intended Directory<![CDATA[ ## Vulnerability Details **File Location**: `scripts/qr.sh`, lines 69-72 **Vulnerability Type**: Path traversal through an unsanitized filename component **Risk Level**: Medium ### Vulnerable Code ```bash local content="WIFI:T:$encryption;S:$ssid;P:$password;;" local output="$QR_DIR/wifi_${ssid}_$(get_timestamp).png" generate_qr "$content" "$output" ``` The resulting path is passed to the file-writing command in `generate_qr`: ```bash qrencode -o "$output" -s 10 -l M "$content" ``` ### Technical Analysis The user-controlled `ssid` value is inserted directly into the output path without removing directory separators, normalizing the path, or verifying that the final destination remains inside `$QR_DIR`. Shell quoting prevents command injection, but it does not prevent filesystem traversal. An SSID containing slash-separated components and `..` sequences can cause path resolution outside the intended QR directory. Because the fixed `wifi_` prefix precedes the SSID, exploitation generally requires the first attacker-selected path component, such as `$QR_DIR/wifi_<component>`, to already exist. This limits but does not eliminate the vulnerability. The destination also has a timestamp and `.png` suffix, restricting which filenames can be targeted. Nevertheless, the script does not enforce its intended output-directory boundary. ### Attack Path 1. An attacker identifies or creates a suitable directory under `$QR_DIR` whose name begins with `wifi_`. 2. The attacker supplies an SSID containing a normal first component followed by `/../` traversal sequences and an external destination path. 3. The script concatenates the SSID into: `"$QR_DIR/wifi_${ssid}_<timestamp>.png"`. 4. Filesystem path resolution processes the embedded traversal components. 5. `qrencode -o` creates or overwrites the resolved PNG destination outside `$QR_DIR`, provided the necessary parent directories exist and the process has write permission. ### Impact Assessment The att ...[truncated 441 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not use the SSID as part of the filesystem path. Generate an opaque filename using a timestamp plus cryptographically random data. - If a descriptive filename is required, replace every character outside a strict allowlist such as `[A-Za-z0-9._-]` with `_`. - Explicitly reject `/`, `\`, `..`, control characters, and empty sanitized names. - Resolve the canonical output directory and candidate path, then verify that the candidate remains beneath the canonical `$QR_DIR`. - Use restrictive file permissions and refuse to overwrite existing files where possible. Example approach: ```bash local safe_id safe_id="$(printf '%s' "$ssid" | tr -c 'A-Za-z0-9._-' '_')" local output="$QR_DIR/wifi_${safe_id}_$(get_timestamp).png" case "$(realpath -m "$output")" in "$(realpath "$QR_DIR")"/*) ;; *) echo "Invalid output path" >&2 return 1 ;; esac ``` Using a fully opaque filename independent of the SSID is preferable. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/qr.sh:42
• Finding: WiFi Password Is Disclosed in Command Output<![CDATA[ ## Vulnerability Details **File Location**: `scripts/qr.sh`, lines 42-44 **Vulnerability Type**: Plaintext sensitive-data exposure in terminal and captured logs **Risk Level**: Medium ### Vulnerable Code `generate_qr` prints the complete QR payload: ```bash if [ $? -eq 0 ]; then echo "✅ QR Code Generated" echo " Content: $content" echo " File: $output" echo " Size: 300x300 (approx)" else ``` For WiFi QR codes, that payload contains the plaintext password: ```bash local content="WIFI:T:$encryption;S:$ssid;P:$password;;" local output="$QR_DIR/wifi_${ssid}_$(get_timestamp).png" generate_qr "$content" "$output" ``` ### Technical Analysis The generic generation function prints its `content` argument after successful QR generation. WiFi mode constructs that argument using the standard WiFi QR representation, including the plaintext password in the `P:` field. As a result, generating a WiFi QR code exposes the password in standard output. In an agent environment, standard output may be retained in conversation transcripts, execution logs, CI logs, monitoring systems, or other log aggregation infrastructure. This unnecessarily expands access to a credential beyond the generated QR image and its intended recipient. ### Attack Path 1. A user or automated agent invokes WiFi QR generation with an SSID and password. 2. `generate_wifi_qr` constructs a plaintext value such as: `WIFI:T:WPA;S:Example;P:secret-password;;`. 3. The value is passed to `generate_qr`. 4. After successful generation, `generate_qr` prints the complete value through `echo " Content: $content"`. 5. Anyone with access to the terminal output, agent transcript, job log, or centralized logging system can recover the WiFi password. ### Impact Assessment The vulnerability discloses WiFi credentials to parties that can read execution output or retained logs. A recovered password may permit access to the associated wireless network with the privileges granted to n ...[truncated 206 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not print the complete content of QR codes that may contain credentials or other sensitive values. - Add a sensitivity flag to `generate_qr`, or provide a dedicated WiFi generation path that prints only non-sensitive metadata. - Return only the generated file path, image size, and a generic content type such as `WiFi configuration`. - Ensure failure and debug logging also redact passwords. - Review execution and agent logs for previously exposed credentials and rotate affected WiFi passwords where necessary. - Apply retention and access controls to logs that may contain historical output. For example: ```bash generate_qr "$content" "$output" "sensitive" ``` Then conditionally omit the payload: ```bash if [ "$3" != "sensitive" ]; then echo " Content: $content" else echo " Content: [REDACTED]" fi ``` ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Linux:**
```bash
sudo apt-get install qrencode zbar-tools
```

## Usage

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README demonstrates passing a WiFi password directly as a shell argument, which can expose sensitive credentials through shell history, process listings, terminal logs, and copied example commands. In a QR-generation skill, this is contextually relevant because users are likely to use real network credentials and may also persist the generated QR image, further increasing accidental disclosure risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly supports generating WiFi and vCard QR codes that can encode passwords, phone numbers, and email addresses, and it states that QR codes are saved to disk by default. Without any warning about sensitive data exposure or storage hygiene, users may unintentionally persist secrets in image files that can be copied, synced, or shared. In this context, the omission is meaningful because the tool is designed to handle credential and contact data, making accidental disclosure more likely.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The WiFi QR feature encodes SSID and password into a PNG file and then calls generate_qr, which prints the full QR content to stdout. That can expose credentials in terminal logs, agent transcripts, or other observability systems, and the generated image also persists the secret on disk without any warning or consent flow. In a QR utility skill, handling secrets is expected, but echoing and persisting them by default increases the risk of unintended disclosure.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The batch mode reads arbitrary lines from an input file and writes a corresponding PNG for each one, but there is no warning or descriptive comment explaining that potentially sensitive input data will be converted into durable files. For a bulk operation, users may not realize that all entries are being materialized to disk in the output directory.

Static analysis

No suspicious patterns detected.