QR Code Generator

A precision utility to generate QR code images from URLs or text using Python.

This skill appears to do what it says (generate QR codes) but exercise caution before installing or using it: 1) The SKILL.md suggests running a python -c one-liner that embeds user text directly — ensure the agent escapes or sanitizes input (or use safer approaches like writing the text to a temporary file and passing the filename to Python) to avoid code injection. 2) The skill will attempt pip install qrcode[pil] at runtime if the library is missing — verify package provenance and, where possible, pre-install dependencies in a controlled environment to avoid unexpected downloads. 3) The README references a ClawHub/GitHub install but the published source/homepage are unknown; prefer skills with verifiable source. 4) Be mindful that output files are written to the agent's working directory and that you should avoid submitting sensitive secrets (e.g., Wi‑Fi passwords) unless you trust the environment. If you want higher assurance, ask for the skill's source repository or a packaged release (so you can review code and dependency requirements) and request the one-liner be replaced with a safer implementation that properly escapes input.

Type: OpenClaw Skill Name: qr-code-generator-skill Version: 1.0.0 The skill's `SKILL.md` defines an execution template that uses `python3 -c` to generate QR codes. This template directly embeds user-provided text (`USER_TEXT_HERE`) and a filename (`FILE_NAME.png`) into a shell command. This design creates a significant shell injection vulnerability if the OpenClaw agent does not rigorously sanitize these inputs before execution, potentially allowing arbitrary code execution or file system manipulation. While not explicitly malicious, this is a critical security flaw.