Is qrcode-barcode-scanner@0.1.1 safe to install?

Skills/ClawHub/qrcode-barcode-scanner

qrcode-barcode-scanner@0.1.1

VERIFIED

Publisher claims: "Scan QR codes, barcodes and supported 2D codes from local PNG, JPEG, WebP and GIF images. Inspect decoded content, formats and measured QR quality diagnostics. Images stay local and decoded links are not opened automatically. Requires Node.js and a separate Rust scanner runtime. Current engine: 0.10.0. By QR Code AI: https://qrcode-ai.com." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher qrcode-ai-com · joined 1 days agoInstalls 191Last detonated 17 h ago

$clawhub install qrcode-barcode-scanner

Watch Report an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-02 and scored it 80/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

HIGH

Host or code assembled from base64 fragmentsscripts/test.mjs:57 · Host or code assembled from base64 fragmentsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.

AST07

HIGH

Access to sensitive file pathsscripts/test.mjs:21 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05