madrid-trademark

• Outcome: Pass
• Latest audit: Oct 11, 2026 · 9:55 AM UTC
• Version: 3.7.7

Overview

This skill is a disclosed Madrid trademark practice assistant with purpose-aligned reference files and user-run calculation/update scripts, and no evidence of hidden control, exfiltration, or persistence.

Installers should understand that this skill includes optional Python utilities that may contact official WIPO sites and may write chosen output files when run. Use it for trademark procedure support, verify live fees/deadlines from official sources, and treat outputs as practice assistance rather than formal legal advice.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (73)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill is presented as a trademark practice assistant, but its documented behavior includes fetching remote content, parsing HTML, and writing local Markdown/files. This mismatch is dangerous because users or host systems may trust it as a content-only legal skill while it actually performs code-adjacent maintenance and data-ingestion actions that expand the attack surface for prompt-triggered network and filesystem operations.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 584)May include surrounding context.

md

入**，技能**不得手工创建**——手工创建会写入**伪造的 ownerId 与发布时间戳**。本技能不设、亦不应新增任何"由平台管理的元数据文件"；版本以 `SKILL.md` frontmatter 的 `version:` 字段为单一真源。

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/madrid-admin-instructions.md (reported line 92)May include surrounding context.

md

第2条
规定表格

凡《实施细则》规定必须使用表格办理的程序，国际局应为之制定表‍格。

第3条
任选表格

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/madrid-admin-instructions.md (reported line 197)May include surrounding context.

md

第2条
规定表格

凡《实施细则》规定必须使用表格办理的程序，国际局应为之制定表‍格。

第3条
任选表格

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/madrid-regulations.md (reported line 175)May include surrounding context.

md

第2条
规定表格

凡《实施细则》规定必须使用表格办理的程序，国际局应为之制定表‍格。

第3条
任选表格

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/madrid-regulations.md (reported line 193)May include surrounding context.

md

第2条
规定表格

凡《实施细则》规定必须使用表格办理的程序，国际局应为之制定表‍格。

第3条
任选表格

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/madrid-regulations.md (reported line 197)May include surrounding context.

md

第2条
规定表格

凡《实施细则》规定必须使用表格办理的程序，国际局应为之制定表‍格。

第3条
任选表格

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/madrid-regulations.md (reported line 270)May include surrounding context.

md

第2条
规定表格

凡《实施细则》规定必须使用表格办理的程序，国际局应为之制定表‍格。

第3条
任选表格

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/madrid-regulations.md (reported line 272)May include surrounding context.

md

第2条
规定表格

凡《实施细则》规定必须使用表格办理的程序，国际局应为之制定表‍格。

第3条
任选表格

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/madrid-regulations.md (reported line 399)May include surrounding context.

md

第2条
规定表格

凡《实施细则》规定必须使用表格办理的程序，国际局应为之制定表‍格。

第3条
任选表格

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/madrid-regulations.md (reported line 465)May include surrounding context.

md

第2条
规定表格

凡《实施细则》规定必须使用表格办理的程序，国际局应为之制定表‍格。

第3条
任选表格

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/madrid-regulations.md (reported line 471)May include surrounding context.

md

第2条
规定表格

凡《实施细则》规定必须使用表格办理的程序，国际局应为之制定表‍格。

第3条
任选表格

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/madrid-regulations.md (reported line 479)May include surrounding context.

md

第2条
规定表格

凡《实施细则》规定必须使用表格办理的程序，国际局应为之制定表‍格。

第3条
任选表格

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/madrid-regulations.md (reported line 527)May include surrounding context.

md

第2条
规定表格

凡《实施细则》规定必须使用表格办理的程序，国际局应为之制定表‍格。

第3条
任选表格

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/madrid-regulations.md (reported line 648)May include surrounding context.

md

第2条
规定表格

凡《实施细则》规定必须使用表格办理的程序，国际局应为之制定表‍格。

第3条
任选表格

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/madrid-regulations.md (reported line 650)May include surrounding context.

md

第2条
规定表格

凡《实施细则》规定必须使用表格办理的程序，国际局应为之制定表‍格。

第3条
任选表格

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/madrid-regulations.md (reported line 671)May include surrounding context.

md

第2条
规定表格

凡《实施细则》规定必须使用表格办理的程序，国际局应为之制定表‍格。

第3条
任选表格

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/madrid-regulations.md (reported line 701)May include surrounding context.

md

第2条
规定表格

凡《实施细则》规定必须使用表格办理的程序，国际局应为之制定表‍格。

第3条
任选表格

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/madrid-regulations.md (reported line 767)May include surrounding context.

md

第2条
规定表格

凡《实施细则》规定必须使用表格办理的程序，国际局应为之制定表‍格。

第3条
任选表格

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/madrid-regulations.md (reported line 778)May include surrounding context.

md

第2条
规定表格

凡《实施细则》规定必须使用表格办理的程序，国际局应为之制定表‍格。

第3条
任选表格

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/madrid-regulations.md (reported line 803)May include surrounding context.

md

第2条
规定表格

凡《实施细则》规定必须使用表格办理的程序，国际局应为之制定表‍格。

第3条
任选表格

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/madrid-regulations.md (reported line 907)May include surrounding context.

md

第2条
规定表格

凡《实施细则》规定必须使用表格办理的程序，国际局应为之制定表‍格。

第3条
任选表格

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/madrid-regulations.md (reported line 995)May include surrounding context.

md

第2条
规定表格

凡《实施细则》规定必须使用表格办理的程序，国际局应为之制定表‍格。

第3条
任选表格

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/madrid-regulations.md (reported line 1051)May include surrounding context.

md

第2条
规定表格

凡《实施细则》规定必须使用表格办理的程序，国际局应为之制定表‍格。

第3条
任选表格

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/madrid-regulations.md (reported line 1124)May include surrounding context.

md

第2条
规定表格

凡《实施细则》规定必须使用表格办理的程序，国际局应为之制定表‍格。

第3条
任选表格