Security audit
Security checks for vulnerabilities and agentic risk
This is mostly a disclosed Dataify Google Patents search skill, but it also enables Google Scholar results despite saying it should not be used for Scholar.
Install only if you are comfortable using a Dataify API token and sending patent-search queries and filters to Dataify. Until the publisher aligns the scope, treat Scholar support as an unexpected extra capability and explicitly keep scholar=false for patent-only use. Do not paste API tokens into chat.
The manifest says the skill should not be used for Google Scholar papers, but the documented parameters explicitly support scholar: "true". This mismatch can cause policy bypass, user deception, or accidental use outside the approved scope, especially in systems that trust manifest metadata for routing or safety decisions.
The manifest says the skill should not be used for Google Scholar papers, but the documented parameters explicitly support scholar: "true". This mismatch can cause policy bypass, user deception, or accidental use outside the approved scope, especially in systems that trust manifest metadata for routing or safety decisions.
Referenced artifact was not completely inspected
python3 scripts/google_patents.py --request "search Google Patents for battery recycling patents" --print-table
Referenced artifact was not completely inspected
python3 scripts/google_patents.py --request "search Google Patents for battery recycling patents" --print-table
Referenced artifact was not completely inspected
python3 scripts/google_patents.py --request "search Google Patents for battery recycling patents" --print-table
Referenced artifact was not completely inspected
python3 scripts/google_patents.py --request "search Google Patents for battery recycling patents" --print-table
The skill appears to rely on environment access, local file reads, and network access, yet it declares no explicit tool scope or permission boundaries. This increases the chance of over-broad execution in agent runtimes, making unintended data access or network use harder to constrain and audit.
Inline documentation expands the skill from patents-only use into Scholar-capable use, directly broadening operational scope beyond the declared intent. In agent ecosystems, documentation often drives behavior, so this can result in unauthorized data retrieval modes or bypass of product-level restrictions.
The documentation contradicts the manifest by describing Scholar support despite the manifest forbidding Scholar use. Contradictory instructions create ambiguity that can lead agents to select a broader behavior than intended, weakening policy enforcement and trust boundaries.
The trigger condition includes broad phrases like '调用 Google Patents' or '专利搜索', which can overlap with ordinary conversation and cause the skill to activate when the user did not clearly intend an external patent-search action. In this context, misfires matter because the skill can drive API usage, consume credits, and route user requests into a third-party workflow without sufficiently specific intent.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Account CTA policy
- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Account CTA policy
- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
- For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management.
- During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.
- For an invalid token, direct the user to API-key management without implying that a new registration is required. For insufficient credits, direct the user to balance or recharge management.
- During normal submission, processing, and successful completion, do not promote registration or the Dashboard. Never expose the token or include it in CTA attribution parameters.
The script defaults scholar=false, but it still exposes scholar as an accepted field, allowing callers to enable Google Scholar results even though the skill metadata explicitly says not to use it for Google Scholar papers. This creates a scope-bypass issue where downstream agents or users can retrieve data outside the declared skill boundary, increasing policy and data-handling risk.
Multiple user-facing strings and parameter descriptions are presented only in Chinese, including defaults, field explanations, and error/help text, without any indication that the skill is region-specific or that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
The natural-language parser explicitly enables scholar=true when user text mentions Google Scholar or scholar-related phrases. Because the skill is declared as patent-only, this behavior broadens the tool's effective capability and can cause an agent to violate intended usage boundaries based on prompt wording alone.
This code sends the assembled patent search parameters to a third-party endpoint via HTTP POST, which may include user-provided query text and filters. While the module docstring says it calls the Dataify API, there is no runtime confirmation, user-facing notice, or explicit warning near the transmission path that request contents are sent off-host.
L075 将“结果语言过滤”直接映射为 language，但文件整体未说明语言/地区选择应由用户明确指定或基于用户偏好决定。按规则，涉及语言/locale 约束时，应提供用户选择或清晰的场景限定，避免隐含地强加特定语言过滤。
The reference explicitly maps several Chinese phrases such as "最新", "最早", and "分组" to parameter values, but does not state that multilingual input is optional or user-selected. This can create an implicit language policy in the skill behavior without documenting user choice or justification.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
params[normalized_key] = cleaned
for field in FIELDS:
value = clean_value(getattr(args, field))
if value is not None:
params[field] = value
This Python file contains natural-language error messages exclusively in Chinese for invalid --params-json input. The policy allows locale constraints only when clearly documented and justified or when the user is given a choice, neither of which appears in this file.
No suspicious patterns detected.