中国专利.Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:39 AM UTC
• Version: 4.5.0

Overview

The patent skill is coherent overall, but it needs review because some helpers make under-scoped web and browser requests while handling potentially confidential patent material.

Install only if you are comfortable with a broad local patent workflow that can read project files, write patent outputs, use browsers, and optionally write to Obsidian or embedding configuration. Avoid processing untrusted URLs or SVG files, keep the temporary SVG server on loopback, pin dependencies in your own environment, and do not enable online embeddings for confidential cases unless the provider and data policy are acceptable.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: skills/patent-reader/tools/vault/clue_vault.py:352

Finding

Arbitrary HTTP(S) URL Fetching Enables Server-Side Request Forgery

Content

View full analysis

dict: """自动抓取 URL 可读摘要；失败不抛错，返回 status=fetch_failed。""" parsed = urlparse(url) if parsed.scheme not in ("http", "https") or not parsed.netloc: return { "ok": False, "status": "fetch_failed", "page_title": "", "summary": "", "error": "invalid_url", } headers = { "User-Agent": ( "Mozilla/5.0 (Windows NT 10.0; Win64; x64) " "AppleWebKit/537.36 (KHTML, like Gecko) " "Chrome/121.0.0.0 Safari/537.36" ), "Accept": "text/html,application/xhtml+xml;q=0.9,*/*;q=0.8", "Accept-Language": "zh-CN,zh;q=0.9,en;q=0.8", } try: req = Request(url, headers=headers) with urlopen(req, timeout=timeout) as resp: raw = resp.read() ``` ### Technical Analysis The validation only confirms that the supplied value uses HTTP or HTTPS and contains a network location. It does not validate the resolved IP address or reject loopback, private, link-local, reserved, multicast, or cloud metadata destinations. The use of `urlopen` can also follow redirects. A URL whose initial destination appears public can consequently redirect the request to an internal address unless every redirect target is independently resolved and validated. Because the response is read and subsequently converted into a summary, this is not limited to blind SSRF. Content returned by an internal service may be included in generated output or persisted in the patent clue vault. ### Attack Path 1. An attacker supplies a patent clue containing an HTTP(S) URL or otherwise causes an attacker-controlled URL to be processed by `fetch ...[truncated 1350 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: skills/patent-disclosure/tools/svg_screenshot.py:91

Finding

Untrusted SVG Rendering Can Trigger External and Internal Network Requests

Content

View full analysis

str: """Resolve relative href / xlink:href to data URIs so a pasted SVG still renders. Nested ``.svg`` files are inlined recursively. Missing or remote hrefs are left as-is. """ seen = _seen or frozenset() def repl(match: re.Match[str]) -> str: raw = match.group(2).strip() if not raw or raw.lower().startswith(_REMOTE_HREF_PREFIXES): return match.group(0) target = (base_dir / raw).resolve() if not target.is_file() or target in seen: return match.group(0) ``` ```python def _screenshot_url(page: Any, url: str, png_path: Path, *, width: int, height: int) -> None: page.set_viewport_size({"width": max(width + 16, 200), "height": max(height + 16, 200)}) page.goto(url, wait_until="domcontentloaded", timeout=30_000) page.wait_for_selector("#stage svg", timeout=15_000) ``` ### Technical Analysis The SVG processing logic deliberately leaves `http:`, `https:`, protocol-relative, and `file:` references unchanged. The resulting SVG markup is embedded in an HTML page and rendered in a headless Chromium browser. When the browser parses the document, embedded references can cause network or local-resource requests. The code does not show request interception, an outbound-domain allowlist, or a restrictive Content Security Policy. Consequently, rendering an untrusted SVG may cause requests to attacker-controlled hosts, loopback services, or private-network endpoints. B ...[truncated 1597 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: skills/patent-disclosure/tools/svg_screenshot.py:142

Finding

User-Selectable HTTP Bind Address Can Expose Confidential SVG Content

Content

View full analysis

ThreadingHTTPServer: class Bound(_SvgHandler): pass Bound.pages = pages httpd = ThreadingHTTPServer((host, port), Bound) thread = threading.Thread(target=httpd.serve_forever, name="svg-http", daemon=True) thread.start() httpd.thread = thread # type: ignore[attr-defined] return httpd ``` ```python pages: dict[str, str] = {} queued: list[tuple[str, Path, Path]] = [] for i, (svg_path, png_path) in enumerate(jobs): if not svg_path.is_file(): report["failed"].append({"svg": str(svg_path), "error": "missing_svg"}) continue key = f"v{i}" try: pages[key] = wrap_svg_html(_load_svg(svg_path)) except OSError as e: report["failed"].append({"svg": str(svg_path), "error": str(e)}) continue queued.append((key, svg_path, png_path)) if not queued: report["error"] = "no_valid_svg" return report port = pick_free_port(host, preferred_port) ``` ```python p.add_argument("--host", default="127.0.0.1") ``` The handler serves the stored SVG-derived page using a predictable identifier: ```python if parsed.path == "/view": key = (parse_qs(parsed.query).get("id") or [""])[0] html = self.pages.get(key) if html is None: self.send_error(404, "unknown id") return data = html.encode("utf-8") self.send_response(200) self.send_header("Content-Type", "text/html; charset=utf-8") self.send_header("Content-Length", str(len(data))) self.end_headers() ...[truncated 2064 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:3

Finding

Broad Unpinned Python Dependency Constraints Create Supply-Chain and Reproducibility Risk

Content

View full analysis

=1.1.0 latex2mathml>=3.77.0 PyYAML>=6.0 playwright>=1.40.0 mammoth>=1.6.0 python-pptx>=0.6.21 ``` `skills/patent-oa/tools/requirements-oa.txt`: ```text sqlite-vec>=0.1.6 PyYAML>=6.0 numpy>=1.24.0 sentence-transformers>=2.2.0 python-docx>=1.1.0 pymupdf>=1.24.0 ``` ### Technical Analysis All reviewed dependencies use broad lower-bound constraints. A fresh installation may therefore select any later version accepted by the resolver, including versions released after the Skill was audited. Several dependencies have substantial transitive dependency graphs or execute complex native and browser-related code. Without exact version locks and artifact hashes, installations are not reproducible and cannot ensure that the artifacts installed in the future are the same artifacts that were reviewed. No custom package index, suspicious direct URL, dependency-confusion package name, or confirmed malicious package was identified. The finding concerns unsafe dependency-management practice rather than evidence that the listed packages are currently malicious. ### Attack Path 1. A direct or transitive dependency publishes a later compromised release, or an upstream package account or distribution artifact is compromised. 2. A user performs a fresh installation using one of the provided requirement files. 3. The package resolver selects the later release because it satisfies the `>=` constraint. 4. Unreviewed code executes during package installation, import, model loading, browser operation, document parsing, or normal Skill execution. 5. The compromised component operates with the filesystem, network, and process privileges of the user running the Skill. ### Impact Assessment ...[truncated 685 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (392)

Dangerous chain: eval() wrapping compile

Critical

• Category: Dangerous Code Execution
• Confidence: 95% confidence

Finding

A dangerous execution chain combines code execution (exec/eval) with a dynamic source (network, encoded data, dynamic import), creating a high-confidence attack vector.

Content

Scanner excerpt · skills/patent-disclosure/tools/formula_eval.py (reported line 239)May include surrounding context.

python

if not _ast_allowed(tree):
        return None, "skip: 含不允许的运算（仅 + - * / min max）"
    try:
        val = eval(compile(tree, "<formula>", "eval"), {"__builtins__": {}}, {"min": min, "max": max})
    except Exception as exc:
        return None, f"skip: 求值失败 ({exc})"
    if not isinstance(val, (int, float)) or not math.isfinite(float(val)):

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied code chunk does not implement or support the declared patent-related functionality in any evident way. It is a test file validating conversion of LaTeX expressions into OMML (Office Math Markup Language), which is a document-formatting/math-rendering concern rather than patent mining, drafting, CNIPA search, policy briefing, or office-action assistance. While formatting tools could theoretically be a minor support component in a larger patent-document system, this specific chunk’s primary purpose is unrelated enough that it constitutes a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The supplied code does not implement the broad patent drafting/search/analysis behaviors described. Instead, its primary purpose is image-processing for patent figures: reading a local source image, rendering a grayscale/contrast-adjusted cropped figure, writing PNG/SVG outputs, and optionally duplicating a file as an abstract figure. While figure preparation could be tangentially related to patent application drafting, this specific capability is not represented in the declared description, which focuses on text-centric patent mining, disclosure drafting, application document generation, CNIPA record search, explanation, policy briefing, and office-action assistance. The code also relies on local filesystem access and Playwright screenshot automation, which are materially different from the declared behaviors. Therefore this chunk is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied code does not implement patent-point mining, patent disclosure/application drafting logic, CNIPA bibliographic search, patent explanation, policy briefing, or office-action response assistance. Its primary function is a generic document-production tool that converts Markdown into Word documents with formatting and math/image support. While such a converter could be a supporting component inside a patent application workflow, the declared description presents the skill as a substantive patent-domain assistant, not as a document conversion utility. Because this code chunk's actual behavior is materially narrower and different in purpose, and introduces undeclared local file transformation capabilities, this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied code does not implement any patent-domain behavior described in the skill declaration. Instead, it provides infrastructure for UTF-8 console and subprocess handling on Windows. While such a utility could be a supporting implementation detail inside a larger patent skill, this chunk by itself has a materially different primary purpose and exposes a generic subprocess-running capability not mentioned in the description. Therefore this code chunk does not accurately represent the declared skill behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is about patent-related legal/technical drafting, CNIPA record search, patent explanation, policy briefing, and office-action assistance. The supplied code instead defines heartbeat configuration and node liveness checking logic for a scheduler or distributed system. This is not a supporting implementation detail for the declared patent skill; it reflects a materially different purpose and unrelated capability. No patent-processing, document drafting, search, policy analysis, or response-assistance behavior is present in the code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied code is unrelated to the declared patent-focused functionality. It defines scheduler data structures and logic for deciding when to reorder tasks and a placeholder API for reordering queued work. There is no behavior مرتبط with patent disclosure drafting, patent application document generation, CNIPA bibliographic search, patent explanation, policy briefing, or office-action support. This is a materially different primary purpose rather than a supporting implementation detail, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is entirely about patent-analysis and patent-drafting workflows. The supplied code instead implements a resource-matching score for a scheduler, based on CPU availability, free memory, I/O busyness, and inflight task penalty. This is not a supporting detail for patent drafting/search/explanation; it reflects a different primary purpose and unrelated capability domain.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is entirely about patent-related workflows and CNIPA-oriented assistance. The supplied code chunk does not implement or support patent drafting, patent search, patent explanation, policy briefing, or office-action response assistance. Instead, it contains unrelated type definitions for a scheduler example in the batch task scheduling domain. This indicates a materially different primary purpose, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The supplied code does not implement patent drafting, patent search, patent explanation, policy briefing, or office-action assistance. Instead, it tests CAD ingestion helpers and STEP/native CAD scanning behavior. While CAD figure handling could be tangentially useful in preparing patent drawings, this chunk’s primary purpose is clearly CAD file processing and test validation, which is not represented in the declared description. Therefore this is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied code does not implement patent drafting, CNIPA record search, patent explanation, policy briefing, or office-action assistance. Instead, it is a test file for CAD/SVG tooling and environment bootstrap behavior. Its primary purpose is materially unrelated to the declared patent skill. Although these are tests rather than end-user features, they still reveal the actual code chunk's behavior, which concerns CAD environment setup and rendering utilities, not patent-processing functions. Therefore the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied code chunk does not implement the declared patent drafting/search/analysis functions. Instead, it contains tests for a specific design-patent figure/line-art gating subsystem, including whether checks are enabled, whether they can be skipped via environment variable, and how view/image inputs are validated and converted into generation jobs. While this may be tangentially related to design patent preparation, the actual behavior is materially narrower and different from the declared purpose, and includes undeclared image/line-art workflow capabilities. Therefore this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied code does not implement patent drafting, CNIPA search, patent explanation, policy briefing, or office-action assistance. Instead, it tests technical utilities for mathematical formula evaluation, chemistry balancing, and unit checks. These are materially different capabilities and suggest a different primary purpose: validating formula-based technical content, possibly for disclosures, but not the declared patent-service functionality itself. No evidence in this chunk supports the declared patent-specific behaviors.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The supplied code does not implement patent drafting, CNIPA search, patent explanation, policy briefing, or office-action assistance. Instead, it tests a mathematical formula-paradigm subsystem: loading paradigm configurations, merging YAML overrides, and validating equation plans with specific constraints. This is a materially different purpose from the declared patent-oriented skill behavior, so the description does not accurately represent the code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The code chunk does not implement or test the core declared patent-skill capabilities such as patent point mining, drafting disclosures/application documents, CNIPA bibliographic search, patent explanation, policy briefs, or office-action assistance. Instead, it is narrowly focused on image-generation workflow logic for figures/images, including whether existing line art qualifies, when to use img2img or txt2img, and how design photos/CAD are treated in disclosures. While patent disclosures can involve figures, this code’s primary purpose is materially different and represents an undeclared capability centered on image-generation planning rather than the declared patent drafting/search/advisory functions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is about substantive patent-domain assistance: drafting patent disclosures/applications, searching Chinese patent bibliographic data, explaining patents, policy briefings, and office-action support. The actual code chunk does none of that. It is purely test code for formatting utilities related to LaTeX delimiters and Mermaid/DOCX rendering in markdown files. This is not a supporting implementation detail of the declared patent functions in any evident way from the supplied chunk; its primary purpose is unrelated document-format validation/testing rather than patent analysis or drafting. Therefore the description does not accurately represent the code behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This code chunk does not implement or test patent-analysis, patent drafting, CNIPA search, patent explanation, policy briefing, or office-action response assistance. Its primary purpose is validating mathematical formula conversion/rendering in document-generation tooling. While document generation could be a supporting detail in a broader patent-writing system, this specific chunk is narrowly focused on equation formatting internals and is materially unrelated to the declared patent-oriented functionality. No undeclared sensitive permissions are evident, but the behavior shown is a clear purpose mismatch with the skill description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied code does not implement patent-related functionality. It is a test file for a math rendering utility, validating parsing and rendering of inline/block LaTeX expressions and handling invalid LaTeX. This is materially different from the declared purpose of patent-point mining, disclosure/application drafting, CNIPA record search, patent explanation, policy briefing, or office-action assistance. The file access and matplotlib dependency are consistent with rendering tests, not with the declared patent skill behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is entirely about patent-domain assistance: disclosure drafting, application document generation, patent search/explanation, policy briefing, and office-action support. The supplied code does not implement any patent functionality. Instead, it contains unit tests for a low-level markdown-to-DOCX table parsing helper. This is a materially different primary purpose and an unrelated capability, so it is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied code does not implement patent analysis, disclosure drafting, CNIPA search, policy briefing, or office-action assistance. Instead, it contains unit tests for a browser utility and Mermaid rendering helper. These are generic tooling/testing functions and represent a materially different purpose from the declared patent-focused skill. While such utilities could be supporting infrastructure, this specific chunk is unrelated enough in function and primary purpose that it should be flagged as a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied code does not implement or support patent drafting, patent search, CNIPA bibliographic retrieval, patent explanation, policy briefing, or office-action assistance. Instead, it is narrowly focused on testing Mermaid-rendering helper behavior for flowchart step labels and Markdown output. This is a materially different primary purpose and indicates a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The supplied code does not implement or directly support patent-disclosure drafting, CNIPA search, patent explanation, policy briefing, or office-action assistance. Instead, it is a standalone test module focused on encoding behavior and math-report formatting for tooling such as stdio_utf8 and md_to_docx. These behaviors are materially unrelated to the declared patent-skill purpose, so this chunk indicates a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is focused on patent-prosecution assistance workflows and patent information tasks. The actual code chunk is unrelated test code for graphical callout overlay generation on technical drawings, likely for labeling parts in images/SVGs. While patent drawings can exist in a patent workflow, this code does not implement the declared core capabilities such as drafting disclosures, rewriting into application document sets, searching CNIPA records, explaining patents, or assisting office-action responses. Its primary purpose is materially different and undeclared, so this is a clear mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The code chunk does not implement patent drafting, patent search, patent explanation, policy briefing, or office-action assistance. Instead, it tests a graphics/layout utility that composes patent-style structure line art into SVG files from source images and placeholders. While such image composition could be tangentially useful in preparing patent figures, that is not the declared purpose, and the code’s primary behavior is materially different from the described patent text workflow. Therefore this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied code does not implement or directly support the declared high-level patent drafting/search/explanation/office-action functions in any visible way. Instead, it tests a specific figure/line-art validation subsystem: validating structure briefs, source image paths, callout overlays, part IDs, and gating behavior for patent drawings. While patent drawings can be a supporting aspect of patent application preparation, this code chunk’s actual purpose is narrowly focused on technical validation of line-art generation inputs and checks, which is not represented in the declared description. Therefore this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: skills/patent-disclosure/tools/formula_eval.py:239