T08 · Insecure Dependencies
Error
- Location
agents/prior-art-researcher/SOUL.md:113- Finding
Automatic Installation of Dynamically Discovered Third-Party Skills
- Content
View full analysis
- Remediation
View remediation
Security audit
专利专业代理 / Patent Professional Agents
Security checks for vulnerabilities and agentic risk
Overview
This patent-assistant skill is patent-focused, but it asks for broad external search, dynamic skill installation, local work-record mining, and persistent learning without tight user control.
Review before installing. Use this only in an isolated project workspace, avoid confidential invention disclosures unless you explicitly approve external searches, do not allow automatic installation of newly discovered skills, disable or tightly scope continuous learning, avoid mining broad memory/ records, and run document conversion as an unprivileged user with sandboxed rendering.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (4)
T02 · Agent Memory Poisoning
Error
- Location
skills/continuous-learning/SKILL.md:24- Finding
Persistent Global Rules Learned from Untrusted Session Content
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:623- Finding
Unscoped Mining of Persistent Work-Memory Records
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
agents/patent-converter/convert_patents.py:152- Finding
User-Controlled Mermaid Rendering Runs with Chromium Sandbox Disabled
- Content
View full analysis
bool: """Convert Mermaid code to PNG""" try: with tempfile.NamedTemporaryFile(mode='w', suffix='.mmd', delete=False, encoding='utf-8') as f: f.write(code) mmd_path = f.name # Create temp Puppeteer config (root user needs --no-sandbox) puppeteer_config = { "args": ["--no-sandbox", "--disable-setuid-sandbox"] } with tempfile.NamedTemporaryFile(mode='w', suffix='.json', delete=False, encoding='utf-8') as f: import json json.dump(puppeteer_config, f) config_path = f.name cmd = [ 'mmdc', '-i', mmd_path, '-o', output_path, '-b', 'white', '-w', '800', '--quiet', '-p', config_path ] result = subprocess.run(cmd, capture_output=True, text=True, timeout=60) os.unlink(mmd_path) os.unlink(config_path) return result.returncode == 0 and os.path.exists(output_path) except Exception as e: print(f"Mermaid conversion error: {e}") return False ``` The Mermaid input originates from patent Markdown: ```python def extract_mermaid_blocks(content: str) -> tuple: """Extract Mermaid code blocks, returns (cleaned_content, mermaid_blocks_list)""" pattern = r'```mermaid\s*\n(.*?)```' matches = list(re.finditer(pattern, content, re.DOTALL)) mermaid_blocks = [m.group(1).strip() for m in matches] ``` ### Technical Analysis Patent Markdown can contain user-controlled Mermaid blocks. The converter writes those blocks to temporary files and invokes Mermaid CLI, which uses Chromium through Puppeteer. The ...[truncated 2272 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (25)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description advertises a broad professional patent-agent suite with nine specialized agents and end-to-end patent services. The actual code chunk implements only one narrow component: converting markdown patent documents into Word documents using a fixed template, with support for section extraction and Mermaid diagram rendering. While 'automatic Word document conversion' is one declared feature and the code aligns with that specific subfeature, it does not substantiate the much broader claimed functionality. Therefore, for the supplied code chunk, the description materially overstates the implemented behavior and primary purpose.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill documents capabilities that imply file reads and shell execution, including reading local patent/work-record files and invoking external commands such as
clawhub search, Pandoc, and Mermaid CLI, but it does not declare an explicit tool scope. That creates a least-privilege failure: a host may grant broader-than-expected access, and users are not clearly informed about what local data or commands may be used.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill omits a clear warning that patent-related content may be sent to third-party search providers such as Tavily, AMiner, Google Patents, or other APIs. Because patent drafts and invention disclosures are highly sensitive and may affect confidentiality or filing strategy, undisclosed external transmission can cause serious IP leakage and privacy harm.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Broad natural-language triggers like 'Help me write a patent' can cause accidental or over-broad invocation on sensitive user content. In a patent workflow, unintended activation is more dangerous because prompts may include confidential invention details that could then be searched externally or written to files automatically.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill expands from patent drafting into ongoing innovation mining from
memory/work records and periodic recommendation notifications, which materially changes the data sensitivity and persistence model. In a patent/IP context, mining internal work logs can expose trade secrets, unpublished inventions, and confidential R&D information without a clearly scoped consent boundary.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill specifies the output as an English-language 'Inventiveness evaluation report' and all required report structure is written in English, but it does not offer the user any language or locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless clearly documented and justified.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md | Risk Level | User Confirmation | |------------|-------------------| | 🟢 Low Risk | No confirmation needed, proceed to drafting | | 🟡 Medium Risk | Prompt user, can choose to continue or optimize | | 🟠 Medium-High Risk | **Must confirm**, user decides whether to continue | | 🔴 High Risk | **Must confirm**, recommend user consider abandoning |
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill’s Input/Output specification and report template are entirely in English, which can effectively steer the agent to answer only in English despite the overall skill metadata claiming bilingual support. In a patent drafting workflow, forcing a single language without explicit user choice can degrade usability, cause misunderstandings in legal/technical content, and conflict with user expectations, though it is not a classic security exploit.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly states that it auto-triggers after review passes and writes the generated .docx into the same directory as the source, but it does not present this as a user-facing warning or require confirmation. That creates a real safety issue because it performs filesystem writes automatically in a potentially user-controlled path, increasing the chance of unexpected modification of working directories or sensitive locations if the input path is wrong or broad.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Install pandoc sudo apt install pandoc # Install mermaid-cli npm install -g @mermaid-js/mermaid-cli
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def md_to_html(md_content: str) -> str: """Convert Markdown to HTML using Pandoc""" try: result = subprocess.run( ['pandoc', '-f', 'markdown', '-t', 'html', '--wrap=none'], input=md_content, capture_output=True,
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 82% confidence
- Finding
This code sends untrusted Mermaid diagram content to the Mermaid CLI, which renders via a headless browser configured with --no-sandbox. Processing attacker-supplied diagram syntax in a browser-based renderer without sandboxing increases the risk that a parser/rendering bug could lead to code execution or broader host compromise, especially if this runs as root as the comments suggest.
- Content
python '-p', config_path ] result = subprocess.run(cmd, capture_output=True, text=True, timeout=60) os.unlink(mmd_path) os.unlink(config_path)
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python print(f"Search directory: {search_dir}") # Check tools pandoc_ok = subprocess.run(['which', 'pandoc'], capture_output=True).returncode == 0 mmdc_ok = subprocess.run(['which', 'mmdc'], capture_output=True).returncode == 0 if not pandoc_ok or not mmdc_ok:
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python # Check tools pandoc_ok = subprocess.run(['which', 'pandoc'], capture_output=True).returncode == 0 mmdc_ok = subprocess.run(['which', 'mmdc'], capture_output=True).returncode == 0 if not pandoc_ok or not mmdc_ok: print("\nError: Missing required tools")
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs the agent to discover, install, and use third-party ClawHub skills at runtime before performing its task. That expands the trust boundary from a fixed patent-search workflow to arbitrary external code/instructions, creating a supply-chain and prompt-injection risk where a malicious or compromised skill could exfiltrate data, alter behavior, or trigger unsafe actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly states it will automatically extract reusable patterns from patent drafting sessions and build an accumulative knowledge base, but it does not provide a clear consent, notice, or retention boundary for user-derived data. In a patent workflow, session content can include confidential inventions, legal strategy, unpublished claims, and client-sensitive material, so silently persisting and reusing this information creates meaningful privacy, confidentiality, and cross-project leakage risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The directory structure and learning flow describe writing observations and instincts to persistent files, including global and project-scoped stores, without any explicit warning, consent mechanism, or safeguards against mixing confidential patent data across matters. Because patent drafting often involves highly sensitive pre-filing information, persistent storage of observations, keywords, corrections, and evolved templates can expose trade secrets, contaminate future work, or leak one client's strategy into another client's session.
- Content
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 70% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
md copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill does not clearly warn users that it writes multiple output files and may auto-convert Markdown into
.docxin the source directory. Silent file creation in directories containing sensitive patent materials can leak information, overwrite expectations, or leave confidential artifacts in shared workspaces.- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The Scenario 2 triggers include broad requests like "Review this patent and provide optimization suggestions," which could match routine discussion rather than an intentional skill invocation. The document does not specify required inputs, scope limits, or non-triggering examples for this optimization path.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
Phrases such as "should I continue or cancel?" are common advisory language and may be too broad for reliable activation without additional context. Although the scenario mentions agency feedback, the trigger section does not clearly require specific inputs or exclude ordinary patent discussions.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 75% confidence
- Finding
The manifest/dependency section declares two search skills, but the documentation for the prior-art researcher extends operational scope to external patent database APIs and additional discovery steps. While still patent-related, this broadens the implementation expectations beyond the concise manifest framing and declared integrations.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The patent-converter section explicitly states a conversion flow based on Pandoc and mmdc, yet the declared dependencies list does not include those tools and only names python-docx. This creates a direct mismatch between the documented implementation intent and the stated installable components for the skill.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code performs a file write by saving a converted Word document alongside the source Markdown file. Although the module docstring mentions the output location, the runtime behavior does not provide a specific user warning or confirmation immediately before creating files, which can matter when operating over multiple discovered documents.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The skill mandates use of specific patent terminology and provides all input/output expectations in English, with no indication that users may choose another language. This can conflict with a language/locale choice policy when the skill is used in multilingual environments.
- Content
Static analysis
No suspicious patterns detected.