ClawHub

QR Code

Security checks across malware telemetry and agentic risk

Overview

The QR-code skill’s purpose is coherent, but its recommended setup asks users to run an unverified remote installer directly on their machine.

Review before installing. The QR-code functionality itself appears purpose-aligned, but do not run the recommended `curl | bash` command blindly. Prefer a pinned release or commit, download and inspect the installer first, verify checksums or signatures if available, and run it only in a contained environment if you cannot verify what it changes.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

External Script Fetching

Low
Category
Supply Chain
Content
For the complete experience with **rounded dots, gradient colors, logo integration, and natural language support**, install from GitHub:

```bash
curl -s https://raw.githubusercontent.com/zouyawen/openclaw-qrcode/main/install.sh | bash
openclaw gateway restart
```
Confidence
98% confidence
Finding
curl -s https://raw.githubusercontent.com/zouyawen/openclaw-qrcode/main/install.sh | bash

External Script Fetching

Low
Category
Supply Chain
Content
```bash
# Full feature installation (recommended)
curl -s https://raw.githubusercontent.com/zouyawen/openclaw-qrcode/main/install.sh | bash

# Python dependencies (installed automatically by the script)
# qrcode[pil], pillow, numpy, pyzbar
Confidence
98% confidence
Finding
curl -s https://raw.githubusercontent.com/zouyawen/openclaw-qrcode/main/install.sh | bash

Chaining Abuse

High
Category
Tool Misuse
Content
For the complete experience with **rounded dots, gradient colors, logo integration, and natural language support**, install from GitHub:

```bash
curl -s https://raw.githubusercontent.com/zouyawen/openclaw-qrcode/main/install.sh | bash
openclaw gateway restart
```
Confidence
99% confidence
Finding
| bash

Chaining Abuse

High
Category
Tool Misuse
Content
```bash
# Full feature installation (recommended)
curl -s https://raw.githubusercontent.com/zouyawen/openclaw-qrcode/main/install.sh | bash

# Python dependencies (installed automatically by the script)
# qrcode[pil], pillow, numpy, pyzbar
Confidence
99% confidence
Finding
| bash

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal