TG 专利价值分析评估

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 9:32 PM UTC
• Version: 1.0.0

Overview

This skill is a straightforward patent valuation prompt that searches public patent information and produces an advisory report, with no evidence of hidden code, persistence, or credential use.

Before relying on outputs, treat the valuation as informational only and verify legal status, market assumptions, and pricing with patent professionals or authoritative databases; installing the skill does not appear to add executable code or persistent access.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
AIGC:
    ContentProducer: Minimax Agent AI
    ContentPropagator: Minimax Agent AI
    Label: AIGC
    ProduceID: 7c56aa53eaab9470d67142dc139c7774
    PropagateID: 7c56aa53eaab9470d67142dc139c7774
    ReservedCode1: 3046022100a0735f8cdd7822275de55be90e438611d37b069d3f895cb28319afad8d27fb9b022100a822e136f9c65c127fd68c2a45614af22e62f31f348d2d8d3683023bbbe22798
    ReservedCode2: 304502206bb77d25620d66d65351e53f54e4492108957813b096447f8cebdb5b1bb91b4b022100fabd6934d19d49c8355ae8627581795dd7ec5daa8549ffc6f9a428450f66330f
description: |-
    专利价值分析评价工具 (V1.0)。用于评估专利资产的多维价值，包括：
    (1) 用户输入专利名称后，进行专利价值评估
    (2) 生成五维价值雷达图（技术、法律、市场、经济、战略）
    (3) 法律稳固性评分与�

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill’s trigger condition is overly broad, covering generic terms like patent retrieval/analysis without tight scope controls. This can cause the skill to activate in unrelated contexts and opportunistically steer conversations into network-based patent lookup and valuation workflows, increasing the chance of unintended data handling or misleading outputs.

Static analysis

No suspicious patterns detected.