Patent Claim Mapper

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:13 AM UTC
• Version: 1.0.0

Overview

The skill is a local patent-claim analysis helper with some documentation and dependency hygiene issues, but no evidence of hidden, destructive, persistent, or exfiltrating behavior.

Before installing, correct the stale `claim_mapper.py` examples or use only `scripts/main.py`, and remove or pin the unnecessary `dataclasses` dependency. Treat generated patent-risk output as preliminary analysis that still needs qualified legal review.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unnecessary Unpinned Third-Party Dependency

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1
Vulnerability Type: Unpinned and unnecessary third-party dependency
Risk Level: Low

Vulnerable Code

text

dataclasses

Technical Analysis

The project documents Python 3.10 or later as its runtime baseline. In these Python versions, dataclasses is included in the standard library, so installing the external backport is unnecessary.

The dependency has no version constraint or integrity hash. Installing requirements.txt therefore causes the package manager to resolve mutable third-party content from its configured package index. This needlessly expands the software supply-chain attack surface. Exploitation would require the configured index, the resolved package distribution, or the package-resolution process to be compromised or otherwise untrusted.

Attack Path

1. A user creates an environment and installs requirements.txt.
2. The package manager resolves the unpinned dataclasses package from a configured package index.
3. If the index, distribution, or resolution path has been compromised, a malicious package artifact is downloaded.
4. Attacker-controlled behavior may execute during package installation or when the package is imported.
5. That behavior runs with the permissions of the user or automation account performing the installation.

This audit found no evidence that the currently declared package is itself malicious; the issue is the unnecessary and unconstrained supply-chain exposure.

Impact Assessment

Successful exploitation could execute code with the privileges of the account installing or running the project. Accessible resources could include files, environment variables, credentials, and network services available to that account. The declaration itself does not provide privilege escalation, persistence, or access beyond the invoking account.

Remediation

View remediation

Remediation Suggestions

1. Remove dataclasses from requirements.txt, because the documented Python 3.10+ runtime provides it in the standard library.
2. Keep requirements.txt empty if the project has no external runtime dependencies, or remove the file if packaging conventions permit.
3. If support for Python versions lacking standard-library dataclasses is genuinely required, document that support and apply an appropriate environment marker.
4. Pin any necessary third-party dependency to reviewed versions and use cryptographic hashes, such as pip’s --require-hashes workflow.
5. Install dependencies only from trusted indexes and scan locked dependency artifacts in CI.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill documents executable scripts and code paths with apparent file read/write capability but does not declare any explicit tool scope or permissions boundaries. In an agent setting, this can lead to over-broad execution assumptions, making it easier for the skill to access or modify files beyond what reviewers or operators expect.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented executable entry point references scripts/main.py, while the substantive implementation examples and CLI usage center on scripts/claim_mapper.py and scripts.claim_mapper. This mismatch can cause users or agents to validate one file and execute another, creating a documentation-to-execution gap that can conceal unintended or unsafe behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The Implementation Details section says the primary implementation surface is scripts/main.py, but later workflow and usage sections direct users toward scripts/claim_mapper.py and scripts.claim_mapper. Contradictory code-path documentation weakens auditability and can be abused to steer reviewers toward a benign path while operational use follows a different, less-reviewed implementation.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

dataclasses

Static analysis

No suspicious patterns detected.