My Generate Qr Code

生成二维码/条形码，支持文本、URL、WiFi 配置等内容，可自定义尺寸、颜色并指定保存路径

This skill appears to do what it claims: generate and save QR images. Before installing or using it consider: (1) it will attempt to run pip at runtime to install 'qrcode' and 'pillow' from PyPI (network download and disk writes) — if you prefer, install those packages yourself ahead of time; (2) it will write files to the filesystem (default: Desktop) and will create directories if necessary — ensure the save path is trusted and writable; (3) there are minor implementation issues (it checks for 'pillow' via __import__('pillow') though Pillow is imported as PIL, and it claims to filter special characters / validate WiFi format but the code does not enforce these), so avoid feeding sensitive data until you review or test behaviour; (4) if you need stricter validation or want to avoid runtime package installs, review/modify the agent.py before use.

Type: OpenClaw Skill Name: my-generate-qr-code Version: 1.0.0 The skill is classified as suspicious due to a critical arbitrary file write vulnerability in `agent.py`. The `save_path` parameter in the `generate_qr` function is directly used to save the image without sufficient sanitization or restriction, allowing an attacker to potentially write files to arbitrary locations on the filesystem via prompt injection against the agent. Additionally, the `install_dependencies` function uses `subprocess.check_call` to install packages, which, while used for legitimate dependencies here, represents a risky capability for executing external commands.