Generate Qrcode

Generate QR codes from URLs or text using a pre-built Python script with qrcode library

The included Python script is small and appears to only create QR-code PNGs — it looks functionally benign. However, the skill is configured with always:true, meaning it will be force-loaded into every agent session (a higher privilege than this utility needs). Before installing, consider: (1) remove or disable the always:true flag so it runs only when you invoke it; (2) verify the qrcode package you install comes from PyPI and is up-to-date; (3) be aware the script will write files to any output path you supply (don't pass sensitive system paths); and (4) because the owner and homepage are unknown, treat it as untrusted code: inspect it locally and, if possible, run it in a restricted environment or container.

Type: OpenClaw Skill Name: qrcode-gen-yn Version: 1.1.1 The skill bundle's `agent.py` script is designed to generate QR codes and save them to a user-specified path. However, it exhibits a path traversal vulnerability as it directly uses the `output_file` argument for `img.save()` and `os.makedirs()` without proper sanitization. This allows an attacker to write files to arbitrary locations on the filesystem (e.g., `../../../../tmp/malicious.png`), which could lead to unauthorized file modification or creation outside the intended skill directory. While not explicitly malicious in intent, this vulnerability poses a significant security risk.