Skill QR Card

Generate styled QR images/cards for ClawHub skills so users can scan and install instantly. Supports install-command payloads, ClawHub links, and GitHub link...

This skill appears coherent and does what it claims, but check a few operational points before running: (1) Ensure your environment has Node and the 'qrcode' npm package (the repo does not declare an install step); (2) ImageMagick's 'convert' is optionally executed to create PNGs — verify you trust the 'convert' binary on the host; (3) The script writes files under ./images/ (it may overwrite similarly named files); (4) If you copy this into an automated agent, ensure the agent only supplies intended slugs/flags (the script will embed whatever you pass into the QR payload). If you want extra caution, run the script in a sandbox or container and review/lock the 'convert' binary before allowing automated invocation.

Type: OpenClaw Skill Name: skill-qr-card Version: 0.1.2 The script `scripts/generate_qr_card.js` contains a shell injection vulnerability where the `--out` command-line argument is passed unsanitized into an `execSync` call to ImageMagick's `convert` utility. While this allows for potential Remote Code Execution (RCE) if an attacker can influence the output filename, there is no evidence of intentional malice or self-exploitation, qualifying it as a critical vulnerability rather than malware.