<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Analyzing QR Code Phishing

## Agent Script

### Commands

| Command | Description |
|---|---|
| `node agent.js decode <image>` | Decode QR code from image |
| `node agent.js analyze-qr <image>` | Decode and analyze for phishing |
| `node agent.js scan-emails <dir>` | Scan directory for QR codes |
| `node agent.js generate-test --url <u> --output <f>` | Generate test QR |
| `node agent.js check-url <url>` | Check decoded URL reputation |

### Examples

```bash
# Decode QR code from suspected phishing email
node agent.js decode /tmp/email_qr.png

# Full phishing analysis of QR code
node agent.js analyze-qr /tmp/email_qr.png

# Scan email attachment directory for QR codes
node agent.js scan-emails /tmp/email_images/

# Generate test QR for phishing simulation
node agent.js generate-test --url "https://sim.company.com/qr" --output /tmp/test.png

# Check the URL decoded from a QR code
node agent.js check-url "https://suspicious-login.xyz/auth"
```

## External Tools

| Tool | Command | Purpose |
|---|---|---|
| zbarimg | `zbarimg --quiet --raw image.png` | CLI QR decode |
| pyzbar | Python library | Programmatic QR decode |
| qrcode | `pip install qrcode[pil]` | QR code generation |
| Pillow | `pip install Pillow` | Image processing |

## Gateway Configuration

| Gateway | QR Detection | Method |
|---|---|---|
| Proofpoint | Yes (TAP) | Image analysis pipeline |
| Mimecast | Yes | QR code URL extraction |
| Microsoft Defender | Partial | Advanced scanning required |
| Google Workspace | Partial | Enhanced pre-delivery scanning |
| Barracuda | Yes | Image-based URL extraction |
