QRCode

Generate styled QR codes (SVG/PNG/JPG) from user input. Supports custom module color, background, dot shape and eye shape, and many output options.

This skill appears to do what it says: generate QR codes. Before installing/running: 1) Ensure Node is available on the agent host (SKILL.md expects 'node'); 2) Be aware 'npm install' will fetch qrcode and sharp from the npm registry—sharp may require native build tools or download prebuilt binaries (network access and build tools may be needed); 3) Confirm how WORKSPACE_ROOT is resolved in your environment (the script computes it as three directories up from the script location); outputs are strictly limited to the script's resolved workspace root and filenames are sanitized, but verify that matches your expected workspace; 4) Note that QR codes encode user-provided data — avoid generating/redistributing codes that point to malicious URLs or include secrets; 5) The registry metadata omission of the 'node' runtime is an administrative inconsistency — consider verifying the SKILL.md metadata and package.json before use. Overall this looks coherent and appropriate for its stated purpose.

Type: OpenClaw Skill Name: qrcode Version: 1.0.1 The OpenClaw AgentSkills 'qrcode' skill is classified as benign. Both the `SKILL.md` instructions and the `scripts/generate.mjs` code demonstrate a strong focus on security. The `SKILL.md` provides clear, non-malicious instructions for the agent, focusing on displaying output and user interaction, with no evidence of prompt injection. The `scripts/generate.mjs` script implements robust security measures, including comprehensive input validation, strict path traversal protection (forcing all outputs to the workspace root via `sanitizeOutputPath`), symlink attack prevention (`safeWriteFile`), resource limits to prevent DoS, and proper XML escaping to prevent SVG injection. There is no evidence of data exfiltration, unauthorized execution, or persistence mechanisms.