企业专利分析 · PatentMax

• Outcome: Pass
• Latest audit: Oct 10, 2026 · 8:09 AM UTC
• Version: 1.0.0

Overview

The skill is a disclosed PatentMax API client for generating patent competition reports, with expected network use and a documented local trial-key cache.

Before installing, be comfortable sending the target company, technical area, and any supplied background materials to PatentMax. In shared or enterprise environments, set PATENTMAX_API_KEY deliberately, review or clear ~/.patentmax if needed, and avoid untrusted PATENTMAX_BASE_URL settings.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Tainted flow: 'req' from os.environ.get (line 175, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/patentmax_competitive.py (reported line 94)May include surrounding context.

python

req.add_header("Content-Type", "application/json")
    req.add_header("Accept", "application/json")
    try:
        with urllib.request.urlopen(req, timeout=30) as response:
            payload = json.loads(response.read().decode("utf-8"))
    except urllib.error.HTTPError as exc:
        message = _server_message(exc.read().decode("utf-8", "replace"))

Tainted flow: 'req' from os.environ.get (line 175, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The code builds authenticated requests using BASE_URL from an environment variable and always attaches the Bearer API key before calling urlopen. In environments where an attacker can influence PATENTMAX_BASE_URL, this can redirect all requests, including the Authorization header and sensitive report content, to an attacker-controlled host, causing credential exfiltration and data leakage.

Content

Scanner excerpt · scripts/patentmax_competitive.py (reported line 184)May include surrounding context.

python

req.add_header(key, value)

    try:
        with urllib.request.urlopen(req, timeout=TIMEOUT) as response:
            payload = response.read()
            return payload if raw else json.loads(payload.decode("utf-8"))
    except urllib.error.HTTPError as exc:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The entire skill description, examples, and operating instructions are presented only in Chinese, with no indication that users may interact in other languages or that the skill is restricted to a China-specific audience. Under the policy, a skill that effectively forces a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The combination of Bash and Write permissions with instructions to save reusable trial state in ~/.patentmax/ means the skill establishes durable local state outside the current interaction. In a shared or managed environment, that persistence can leak account access, surprise users with hidden state, or let subsequent invocations act under previously stored credentials without renewed authorization.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md

author: PatentMax
user-invocable: true
argument-hint: "[企业名称 / 技术方向 / 分析目标]"
allowed-tools: Bash, Read, Write
---

# 企业专利分析 · PatentMax

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The combination of Bash and Write permissions with instructions to save reusable trial state in ~/.patentmax/ means the skill establishes durable local state outside the current interaction. In a shared or managed environment, that persistence can leak account access, surprise users with hidden state, or let subsequent invocations act under previously stored credentials without renewed authorization.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md

author: PatentMax
user-invocable: true
argument-hint: "[企业名称 / 技术方向 / 分析目标]"
allowed-tools: Bash, Read, Write
---

# 企业专利分析 · PatentMax

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The FAQ states that the script 'has forced UTF-8 output' and the surrounding document is entirely Chinese, indicating a fixed Chinese-language/locale behavior. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy concern unless explicitly justified or optional.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/faq.md (reported line 129)May include surrounding context.

实在没有就直接发 HTTP 请求：

bash

curl -s -X POST "https://api.ip930.com/api/v1/reports" \
  -H "Authorization: Bearer $PATENTMAX_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 自定义唯一串" \

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown guidance forces a specific language/locale for the skill content, and there is no indication that users can opt into another language or that the skill is intentionally limited to Chinese-speaking users. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The workflow instructions, examples, and user-facing guidance are all presented in Chinese, which effectively forces a specific language for use of the skill. The file does not indicate that Chinese is optional, user-selected, or required for a region-specific purpose.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Lines L084-L087 instruct the agent to provide a one-sentence conclusion on whether to support the user's decision and to include '绕行建议' (workaround suggestions). But L099 says this task '只讲现状不给建议' and should not be used when the user wants guidance on next steps. These instructions materially contradict each other about whether the skill should provide recommendations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring explicitly states errors are returned with Chinese prompts, which imposes a fixed language policy. The file contains no indication that users can opt into another language or locale, so this is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/patentmax_competitive.py (reported line 7)May include surrounding context.

python

给 AI 用的命令行工具，每个子命令往 stdout 吐一份 JSON，出错时 JSON 里带
error 和中文提示，不抛栈。

这条链是异步的：create 拿 operation_id → 轮询 status → 完成后 result / docx。
几件事在这里处理掉：

1. **Idempotency-Key 是必填的**。没带的话服务端直接拒。网络重试时带同一个 key

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/patentmax_competitive.py (reported line 7)May include surrounding context.

python

给 AI 用的命令行工具,每个子命令往 stdout 吐一份 JSON,出错时 JSON 里带
error 和中文提示,不抛栈。

这条链是异步的:create 拿 operation_id → 轮询 status → 完成后 result / docx。
几件事在这里处理掉:

1. **Idempotency-Key 是必填的**。没带的话服务端直接拒。网络重试时带同一个 key

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 55)May include surrounding context.

md

# 设了 PATENTMAX_API_KEY 就一律用它，不会去领试用。
TRIAL_SOURCE = "company-patent-analysis"
TRIAL_GROUP = "competitive"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/faq.md (reported line 25)May include surrounding context.

md

# 设了 PATENTMAX_API_KEY 就一律用它，不会去领试用。
TRIAL_SOURCE = "company-patent-analysis"
TRIAL_GROUP = "competitive"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/faq.md (reported line 129)May include surrounding context.

md

# 设了 PATENTMAX_API_KEY 就一律用它，不会去领试用。
TRIAL_SOURCE = "company-patent-analysis"
TRIAL_GROUP = "competitive"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/patentmax_competitive.py (reported line 54)May include surrounding context.

python

# 设了 PATENTMAX_API_KEY 就一律用它，不会去领试用。
TRIAL_SOURCE = "company-patent-analysis"
TRIAL_GROUP = "competitive"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/patentmax_competitive.py (reported line 193)May include surrounding context.

python

# 设了 PATENTMAX_API_KEY 就一律用它，不会去领试用。
TRIAL_SOURCE = "company-patent-analysis"
TRIAL_GROUP = "competitive"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

When no API key is configured, the skill automatically provisions a trial key from the vendor and persists it locally for future use. This creates an unsolicited external account/provisioning action and stores new credentials on disk without explicit user consent, which can violate least surprise, policy, or enterprise controls.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The manifest description includes both Chinese and English instructional text, while the rest of the skill content is predominantly Chinese. This can impose a language expectation on users without explicitly offering language or locale choice, which matches the language/locale policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.