Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - ① 交付格式与输出契约类（六 6.4 约束A/B、星标体系、禁 Markdown 表格）——以 `SKILL.md` 为准；
Security audit
hague-design-system
Security checks for vulnerabilities and agentic risk
Overview
This skill is a Hague design-registration legal reference with disclosed fee-checking helpers, and I found no hidden persistence, credential access, exfiltration, or destructive behavior.
Before installing, treat this as a legal-practice aid rather than legal advice. Use official WIPO/CNIPA pages to confirm current fees and deadlines, and avoid sending confidential application details or credentials when contacting support. The helper scripts should be run only for fee-checking tasks you intend, especially if using options that write output files.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (28)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - ① 交付格式与输出契约类（六 6.4 约束A/B、星标体系、禁 Markdown 表格）——以 `SKILL.md` 为准；
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - ① 交付格式与输出契约类（六 6.4 约束A/B、星标体系、禁 Markdown 表格）——以 `SKILL.md` 为准；
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 85% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
md Bureau or via the Office of a Contracting Party (refer to “Channels of communication”). Rule 7(1) Annex I to form DM/1 allows the applicant to submit a “Declaration of Inventorship” or, if not possible, a “Substitute Statement in Lieu of a Declaration of Inventorship”, in respect of a designation of the United States of America. This is mandatory if the United States of America is designated. Annex II allows the applicant to submit documentation in support of a declaration concerning exception to lack of novelty in respect of designation of China,
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 85% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
md Bureau or via the Office of a Contracting Party (refer to “Channels of communication”). Rule 7(1) Annex I to form DM/1 allows the applicant to submit a “Declaration of Inventorship” or, if not possible, a “Substitute Statement in Lieu of a Declaration of Inventorship”, in respect of a designation of the United States of America. This is mandatory if the United States of America is designated. Annex II allows the applicant to submit documentation in support of a declaration concerning exception to lack of novelty in respect of designation of China,
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 85% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
md contain indications of the identity of the creator. At present, only the United States of America has made such a declaration. Annex I to form DM/1 (refer to “Annex I: Oath or Declaration of the Creator”) and the eHague Filing interface allows the applicant to submit a declaration of inventorship (or, if not possible, a substitute statement in lieu of a declaration of inventorship) for the designation of the United States of America. It is mandatory content for an international application designating the United States of America. 99 Article 10(2)(b); Rule 7(4)(a); Rule 8(1),(2) and (3))
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 85% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
md contain indications of the identity of the creator. At present, only the United States of America has made such a declaration. Annex I to form DM/1 (refer to “Annex I: Oath or Declaration of the Creator”) and the eHague Filing interface allows the applicant to submit a declaration of inventorship (or, if not possible, a substitute statement in lieu of a declaration of inventorship) for the designation of the United States of America. It is mandatory content for an international application designating the United States of America. 99 Article 10(2)(b); Rule 7(4)(a); Rule 8(1),(2) and (3))
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 85% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
md contain indications of the identity of the creator. At present, only the United States of America has made such a declaration. Annex I to form DM/1 (refer to “Annex I: Oath or Declaration of the Creator”) and the eHague Filing interface allows the applicant to submit a declaration of inventorship (or, if not possible, a substitute statement in lieu of a declaration of inventorship) for the designation of the United States of America. It is mandatory content for an international application designating the United States of America. 99 Article 10(2)(b); Rule 7(4)(a); Rule 8(1),(2) and (3))
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill explicitly references network access, local file reads, and bundled scripts, while also stating that no whitelist is enabled for tools. In an agent environment, this creates unnecessary capability exposure: the skill can induce network fetches and file interactions beyond what is minimally needed, increasing the blast radius if the skill is misused or prompt-injected.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger list contains broad keywords such as 'Hague', 'DM/1', 'eHague', and generic Chinese equivalents that may appear in ordinary discussion. Over-broad activation can cause the skill to engage in contexts where it was not intended, pulling in networked/tool-using behavior and possibly superseding more appropriate skills or base-model handling.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The activation guidance instructs activation on many generic keywords without defining exclusion criteria, ambiguity handling, or confirmation steps. In practice, this raises the risk of unintended invocation, which is more concerning here because the skill encourages live retrieval from external sources and interaction with multiple reference assets.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md Where the payment is made through the International Bureau, the International Bureau will record the payment in the International Register and notify the Office concerned (IMPI or USPTO) accordingly. No confirmation of payment will be sent to the representative/holder. The International Bureau will not accept a late payment. Where the second part of the individual designation fee is paid through the International Bureau, the date of the payment will be the date on which the International Bureau receives the required amount. Thus, for
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The entire skill reference file is written in Chinese and provides no indication that users may choose another language or that the language restriction is an intentional, documented locale constraint. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
该 markdown 文件包含自然语言规则文本，L0133-L0147 明确规定国际申请和相关通信只能使用英语、法语或西班牙语。按本审计规则，强制特定语言且未体现用户选择或 opt-in，构成语言/区域政策层面的自然语言限制。
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The entire skill file is written in Chinese and provides no natural-language indication that other languages are supported or that Chinese is an explicitly user-selected option. Under the stated policy, forcing a specific language without user opt-in can be a locale-policy violation unless the constraint is clearly documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
Line L0003 describes the file as a Chinese-localized copy of an official English text, which imposes a specific language/locale in the document metadata. Under the stated policy, forcing a language without user opt-in can be a natural-language locale-policy issue, and no choice or justification is provided in the file itself.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This markdown file is entirely written in Chinese and presents itself as guidance content without stating that it is intended specifically for Chinese-speaking users or offering an alternate language option. Under the policy rule for language or locale constraints, this can be considered a natural-language locale preference that is not explicitly framed as a justified regional limitation within the file itself.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The document instructs that application documents '应当使用英文撰写，并提供中国内地中文通信信息', which imposes specific language requirements. As a natural-language policy issue, this is a locale/language constraint presented without offering user choice or clarifying that the constraint is mandated by the external CNIPA/WIPO process.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The text states that responses must use Chinese for arguments and English for amendments, which is a fixed language requirement. Although likely procedural, the document does not explicitly frame this as a justified external requirement, so it appears as a language-policy constraint without opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
This markdown file contains only Chinese-language content and does not indicate any user opt-in, alternative language availability, or explicit justification for a fixed language choice. Under the policy, forcing a specific language without opt-in can be a natural-language policy concern.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
At L47, the file tells users to contact WIPO technical support at a specific email address during an access failure scenario. Because support emails can include application details, identifiers, or screenshots, the skill description should disclose the privacy implication or advise users to limit shared data.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Line L075 states that application documents must be written in English and that Chinese mainland communication information must be provided. This imposes a locale/language constraint in natural language without presenting it as a user-selectable option or clearly framing it as a justified regional limitation within a region-specific compliance context.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
Lines L207-L211 describe Chinese design patent filing as being in Chinese, while contrasting Hague filings as English/French/Spanish. Although this may be factually true for the jurisdiction, the text states the language policy categorically and does not explicitly frame it as a jurisdiction-specific requirement or offer language/locale choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This JSON embeds user-facing descriptive text entirely in Chinese, including scope and notice fields that appear intended for downstream display or operator guidance. The file does not indicate that Chinese is optional, localized by user preference, or justified as a region-specific constraint, which can conflict with language/locale choice expectations.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The
individual_source_notefield contains operational guidance in Chinese and appears meant for human interpretation during use or maintenance. Because no language-selection mechanism or justification is present in this file, it represents a natural-language locale constraint without opt-in.- Content
Static analysis
No suspicious patterns detected.