← 返回 Skills 市场

我的二维码生成技能

Name: 我的二维码生成技能
Author: yangzhenfu

作者杨振甫 · GitHub ↗ · v1.0.0

cross-platform ⚠ suspicious

499

总下载

当前安装

版本数

在 OpenClaw 中安装

/install generate-qr-code

功能描述

生成文本、URL或WiFi信息的二维码，支持自定义尺寸、颜色，二维码图片保存到指定路径，默认为桌面。

使用说明 (SKILL.md)

Generate QR Code Skill（生成二维码技能）

1. Description

当用户需要将文本、URL、WiFi 信息等转换为可视化二维码时，使用此技能生成二维码图片，并保存到指定路径（默认保存到桌面），支持自定义尺寸和颜色。

2. When to use

用户说：“帮我把 https://openclaw.ai 生成二维码”
用户说：“生成一个包含 WiFi 信息的二维码，名称：MyWiFi，密码：12345678”
用户说：“生成黑色二维码，内容是‘Hello OpenClaw’，保存到 D 盘根目录”
用户说：“帮我做一个 400px 大小的二维码，内容是我的手机号 13800138000”

3. How to use

从用户消息中提取核心参数：
- 必选：生成内容（文本/URL/WiFi 信息，WiFi 格式需为“WIFI:S:名称;T:类型;P:密码;;”）；
- 可选：尺寸（默认 300px）、颜色（默认黑色）、保存路径（默认桌面）；
若用户未指定可选参数，使用默认值；
调用 agent.py 中的 generate_qr 函数执行生成操作；
返回结果：告知用户二维码保存路径，若生成失败，说明具体原因（如路径无权限、内容为空）。

4. Implementation（代码关联说明）

依赖库：qrcode（生成二维码）、Pillow（图片处理）；
核心函数：async def generate_qr(text: str, size: int = 300, color: str = "black", save_path: str = None)；
参数说明：
- text：二维码内容（必选）；
- size：二维码尺寸（单位 px，默认 300）；
- color：填充颜色（默认 black，支持英文颜色名或十六进制色值，如 #FF0000）；
- save_path：保存路径（默认桌面，文件名：qr_code.png）。

5. Edge cases

内容为空：回复“请提供需要生成二维码的内容（如文本、URL、WiFi 信息）”；
保存路径无权限：回复“指定路径无写入权限，请更换保存路径（如桌面）”；
未安装依赖库：自动尝试安装 qrcode 和 Pillow，若安装失败，提示用户手动执行“pip install qrcode pillow”；
特殊字符内容：自动过滤无效字符，确保二维码可正常识别。

安全使用建议

This skill appears to do what it claims: generate and save QR images. Before installing/using: (1) be aware the Python file will try to pip-install 'qrcode' and 'pillow' at runtime — if you prefer, install these packages yourself in a virtual environment or pin versions; (2) the skill will write files to the path you specify (defaults to your Desktop) and will create directories as needed—avoid giving paths you don't want modified; (3) running code that performs pip installs fetches code from PyPI (network) so run in a controlled environment if you are concerned; (4) if you want extra safety, review the agent.py source locally and run it in a sandboxed/python venv before granting broader access.

功能分析

Type: OpenClaw Skill Name: generate-qr-code Version: 1.0.0 The skill is classified as suspicious due to two main reasons in `agent.py`. First, it uses `subprocess.check_call` to automatically install dependencies (`qrcode`, `pillow`). While the package names are hardcoded, this demonstrates the ability to execute arbitrary system commands, which is a powerful primitive that could be exploited if the package names were dynamic or if the `pip` supply chain were compromised. Second, the `generate_qr` function directly uses the `save_path` parameter for file saving and directory creation (`os.makedirs`, `img.save`) without apparent sanitization. This creates an arbitrary file write/path traversal vulnerability, allowing a malicious user to potentially write files to arbitrary locations on the filesystem if the OpenClaw agent does not sanitize user input for `save_path`.

能力评估

✓ Purpose & Capability

Name/description (generate QR codes, customize size/color, save to path) align with the bundled SKILL.md and agent.py. The code implements generate_qr(text,size,color,save_path) and uses qrcode/Pillow as described—no unrelated services or credentials are requested.

ℹ Instruction Scope

SKILL.md and agent.py stay within the stated purpose. The skill writes image files to disk (user-specified path or Desktop) and will create directories if missing — this is necessary for saving output. One minor note: the code reads the USERPROFILE environment variable when choosing the Windows desktop path (os.environ["USERPROFILE"]) but the registry metadata declares no env vars; this is a small implementation detail rather than a scope creep.

ℹ Install Mechanism

There is no install spec in the registry; instead agent.py attempts to auto-install missing dependencies at runtime using subprocess.check_call([sys.executable, "-m", "pip", "install", package]). Installing from PyPI at runtime is common but has moderate risk (network fetch, executing package install hooks). This behavior is expected for a Python instruction-only skill but consider pre-installing or pinning versions.

✓ Credentials

The skill does not request credentials or config paths. It does read USERPROFILE (for Windows desktop path) and uses os.path.expanduser on other OSes; this is proportional to the need to compute a default save location. No other environment variables or secrets are accessed or transmitted.

✓ Persistence & Privilege

The skill is user-invocable, not always-enabled, and does not modify other skills or global agent settings. It writes files only to user-specified locations (or default Desktop) and does not request persistent elevated privileges.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install generate-qr-code
安装完成后，直接呼叫该 Skill 的名称或使用 /generate-qr-code 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

支持根据用户的需求生成二维码

元数据

Slug generate-qr-code

版本 1.0.0

许可证 —

累计安装 5

当前安装数 4

历史版本数 1

常见问题