T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:674- Finding
Remote NodeSource Setup Script Is Executed Directly by a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
Professional Patent Agents
Security checks for vulnerabilities and agentic risk
Overview
This patent drafting skill is mostly purpose-aligned, but it asks agents to install newly discovered skills, persist learned behavior globally, and run risky conversion setup/execution steps without enough user control.
Review before installing. Use this only in an isolated, non-root environment; do not run the curl-to-bash setup as written; pin and verify dependencies; disable or tightly review continuous learning and global instincts; require approval before installing any additional ClawHub skills; and confirm every confidential patent file/path before search, conversion, or external API use.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (4)
T08 · Insecure Dependencies
Error
- Location
agents/prior-art-researcher/SOUL.md:113- Finding
Automatically Discovered ClawHub Skills May Be Installed and Invoked Without Security Review
- Content
View full analysis
- Remediation
View remediation
T02 · Agent Memory Poisoning
Error
- Location
skills/continuous-learning/SKILL.md:9- Finding
Session-Controlled Observations Can Be Persisted as Automatically Applied Global Rules
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
agents/patent-converter/convert_patents.py:91- Finding
Mermaid Rendering Disables the Chromium Sandbox When Run as Root
- Content
View full analysis
bool: """Convert Mermaid code to PNG. Security notes: - Running as a non-root user is recommended. - If root execution is required, mmdc needs --no-sandbox. - This reduces browser sandbox security; use an isolated environment. """ try: with tempfile.NamedTemporaryFile( mode='w', suffix='.mmd', delete=False, encoding='utf-8' ) as f: f.write(code) mmd_path = f.name cmd = [ 'mmdc', '-i', mmd_path, '-o', output_path, '-b', 'white', '-w', '800', '--quiet' ] is_root = os.geteuid() == 0 if hasattr(os, 'geteuid') else False if is_root: puppeteer_config = { "args": ["--no-sandbox", "--disable-setuid-sandbox"] } with tempfile.NamedTemporaryFile( mode='w', suffix='.json', delete=False, encoding='utf-8' ) as f: import json json.dump(puppeteer_config, f) config_path = f.name cmd.extend(['-p', config_path]) result = subprocess.run( cmd, capture_output=True, text=True, timeout=60 ) ``` ### Technical Analysis Mermaid content is extracted from patent Markdown and passed to `mmdc`, which uses a Chromium/Puppeteer rendering process. Patent Markdown is potentially user-controlled. When the converter detects root execution, it explicitly supplies both `--no-sandbox` and `--disable-setuid-sandbox`. ...[truncated 1989 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (20)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill declares capabilities and installation/usage flows that rely on reading local files and invoking shell commands, but it does not define any explicit tool scope restrictions such as allowed tools or permissions. In an agent environment, this increases the chance of overbroad tool access, unintended file exposure, or arbitrary command execution if the skill is invoked on untrusted inputs or paths.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger phrases for Scenario 1 are broad enough to match common conversational requests about patents, which can cause the skill to activate unexpectedly. In a skill with search, file, and shell-adjacent workflows, accidental invocation can lead to unnecessary data handling, network access, or document generation beyond user intent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Scenario 2 uses ambiguous review/optimization phrases that can overlap with ordinary discussion or requests for feedback on patent text. Because this scenario may parse provided paths and drive downstream search and document workflows, loose activation criteria increase the risk of processing sensitive files unintentionally.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Scenario 3 trigger phrases are conversationally broad and can match routine discussion about patent risk or agency feedback. Given the skill's decision-support and file-oriented behavior, accidental activation may expose sensitive reports to external tools or initiate unwanted processing on confidential application materials.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file specifies the output format in English as the required report template, and the rest of the instructions consistently enforce English-language headings and content. This creates a language-policy issue because the skill does not offer the user a language choice or explain why English is required for this workflow.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 91% confidence
- Finding
The skill authorizes the agent to proceed automatically to drafting for 'Low Risk' cases without explicit user confirmation. In a professional patent workflow, this can cause the system to take consequential action based on its own legal/technical judgment, potentially advancing a filing strategy the user did not approve.
- Content
md | Risk Level | User Confirmation | |------------|-------------------| | 🟢 Low Risk | No confirmation needed, proceed to drafting | | 🟡 Medium Risk | Prompt user, can choose to continue or optimize | | 🟠 Medium-High Risk | **Must confirm**, user decides whether to continue | | 🔴 High Risk | **Must confirm**, recommend user consider abandoning |
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The input/output specification requires a 'Complete patent Markdown document' and defines a fixed English report template, but the file does not offer any language choice or explain that the skill is intentionally limited to a specific locale. This creates a natural-language policy concern because the skill appears to impose a language convention by default rather than allowing user preference.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill specifies automatic conversion that writes a .docx file into the same directory as the source markdown without requiring an explicit user confirmation or warning. In an agentic workflow, automatic file creation/modification in user-controlled directories can cause unintended side effects, overwrite adjacent outputs, or violate user expectations about when filesystem changes occur.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Install pandoc sudo apt install pandoc # Install mermaid-cli npm install -g @mermaid-js/mermaid-cli
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def md_to_html(md_content: str) -> str: """使用 Pandoc 将 Markdown 转换为 HTML""" try: result = subprocess.run( ['pandoc', '-f', 'markdown', '-t', 'html', '--wrap=none'], input=md_content, capture_output=True,
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 86% confidence
- Finding
This subprocess call executes Mermaid CLI on attacker-controlled Mermaid content, and when running as root it intentionally disables Chromium sandboxing via --no-sandbox/--disable-setuid-sandbox. That creates a real risk because untrusted diagram input is rendered by a browser-based tool, increasing exposure to CLI/browser/parser vulnerabilities and making compromise more severe in privileged environments.
- Content
python config_path = f.name cmd.extend(['-p', config_path]) result = subprocess.run(cmd, capture_output=True, text=True, timeout=60) # 清理临时文件 os.unlink(mmd_path)
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python print(f"搜索目录: {search_dir}") # 检查工具 pandoc_ok = subprocess.run(['which', 'pandoc'], capture_output=True).returncode == 0 mmdc_ok = subprocess.run(['which', 'mmdc'], capture_output=True).returncode == 0 if not pandoc_ok or not mmdc_ok:
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python # 检查工具 pandoc_ok = subprocess.run(['which', 'pandoc'], capture_output=True).returncode == 0 mmdc_ok = subprocess.run(['which', 'mmdc'], capture_output=True).returncode == 0 if not pandoc_ok or not mmdc_ok: print("\n错误: 缺少必要工具")
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs the agent to search ClawHub, install whatever patent-related skill is found, and then use it. That expands execution beyond the declared patent-search role into dynamic capability acquisition from untrusted sources, creating a supply-chain and prompt-injection risk because newly installed skills may contain unsafe instructions, exfiltration behavior, or broader tool access. In this context, the requirement to do this 'always' makes the issue more dangerous because the agent is pushed to perform the unsafe action by default rather than only under explicit user approval.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The skill specifies communication style and output structure entirely in English and gives no indication that the user may choose another language. Under the stated policy, a skill that imposes a specific language without opt-in can be a natural-language policy violation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The file-level description promises automatic extraction of reusable patterns without clearly constraining when it runs or what data sources are eligible. Because the skill stores observations and evolves them into global knowledge artifacts, this ambiguity increases the risk of silently persisting sensitive user content, overgeneralizing from one project, or incorporating untrusted external inputs into future behavior.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger conditions are broad enough to activate learning on loosely defined events such as effective strategies, user corrections, API access, or discovering external skills. In a continuous-learning skill, this can cause unbounded collection and persistence of session-derived information, including sensitive project details or external tool suggestions, without clear gating, approval, or scope limits.
- Content
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 70% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
md copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
External Script Fetching
Low
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
The documentation instructs users to fetch and immediately execute a remote script via 'curl ... | bash', which is a classic unsafe installation pattern. If the remote source is compromised, intercepted, or replaced, users may execute arbitrary code during setup, and this skill already expects shell access in its operational context.
- Content
md apt install pandoc # 2. Install Node.js and mermaid-cli (Mermaid diagram rendering) curl -fsSL https://deb.nodesource.com/setup_18.x | bash - apt install nodejs npm install -g @mermaid-js/mermaid-cli
Static analysis
No suspicious patterns detected.