二维码生成器

Generate QR codes from text, URLs, or images. Use when users ask to 'generate QR code', 'create QR', or 'make QR code for'. Supports text content, URLs, and...

This skill appears to do exactly what it says. Before installing or invoking it: (1) only provide image file paths you trust (the skill will read the file and may embed it in the QR), (2) be aware embedding whole images as base64 often creates very dense or unscannable QR codes—use an image URL when possible, (3) install the listed Python packages in a virtualenv to avoid system-wide package changes, and (4) review/scan the included agent.py if you require extra assurance (it currently performs only local file reading, base64 encoding, and writing to the temp directory).

Type: OpenClaw Skill Name: pr-generator Version: 3.0.0 The `agent.py` skill is suspicious due to a Local File Inclusion (LFI) vulnerability. The `image_path` parameter in the `handle_call` function, which is processed by `file_to_base64`, allows reading arbitrary files on the system (e.g., `/etc/passwd`, `~/.ssh/id_rsa`). The content of these files is then base64 encoded and embedded into a QR code image, whose path is returned by the skill. While the skill's stated purpose is to generate QR codes from images, the lack of input sanitization or path restrictions on `image_path` creates a significant information disclosure risk, allowing an attacker to potentially extract sensitive data via crafted input. There is no evidence of intentional malicious behavior like exfiltration to external servers or backdoor installation, classifying this as a vulnerability rather than malware.