Global Patent Search · PatentMax

• Outcome: Pass
• Latest audit: Oct 15, 2026 · 3:33 AM UTC
• Version: 1.1.1

Overview

This is a disclosed PatentMax patent-search client that sends patent queries to its API and stores a local trial/API key, with no evidence of hidden or destructive behavior.

Install only if you are comfortable sending patent numbers, search terms, company names, and possibly technical descriptions to PatentMax. Do not submit confidential invention details, source code, formulas, or trade secrets unless the user has approved that disclosure. Keep API keys out of shared files, leave the API base URL at the official default unless you intentionally trust another endpoint, and review local ~/.patentmax files if you need to remove cached trial credentials or results.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (39)

Tainted flow: 'req' from os.environ.get (line 307, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/patentmax_client.py (reported line 118)May include surrounding context.

python

req.add_header("Content-Type", "application/json")
    req.add_header("Accept", "application/json")
    try:
        with urllib.request.urlopen(req, timeout=30) as response:
            payload = json.loads(response.read().decode("utf-8"))
    except urllib.error.HTTPError as exc:
        message = _server_message(exc.read().decode("utf-8", "replace"))

Tainted flow: 'req' from os.environ.get (line 307, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 91% confidence

Finding

The client builds authenticated requests using environment-derived BASE_URL and API_KEY, then sends them with an Authorization bearer token to whatever host BASE_URL names. If an attacker can influence PATENTMAX_BASE_URL, they can exfiltrate the API key and all patent queries/results to an attacker-controlled endpoint, creating an SSRF-style credential leak and data exfiltration path.

Content

Scanner excerpt · scripts/patentmax_client.py (reported line 318)May include surrounding context.

python

req.add_header(key, value)

    try:
        with urllib.request.urlopen(req, timeout=TIMEOUT) as response:
            payload = response.read()
            # 服务端每个响应都回本次实扣和扣完后的余额。记下来，供 _spent/_balance 输出。
            # 拿服务端的真值，而不是在本地累加估价：跨进程累加迟早算岔，

Lp1

High

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The script reads sensitive configuration from environment variables, including PATENTMAX_API_KEY and PATENTMAX_BASE_URL, but the finding indicates this capability is not declared in the skill's permissions model. That mismatch can undermine review expectations and allow the skill to access secrets or routing controls that operators did not realize it needed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The entire installation guide is written in Chinese and presents all user-facing instructions, examples, and troubleshooting exclusively in that language. Under the policy rule, forcing a specific language without user opt-in is a natural-language locale violation unless a justified region-specific constraint is documented.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 83% confidence

Finding

This example instructs users to send authenticated requests, including search queries, to a third-party external service using a bearer token. In an agent-skill context, that creates a real data-exfiltration path because user prompts, patent queries, and API credentials may be transmitted off-platform to a non-local service, and the documentation does not foreground consent, data handling, or query-sensitivity restrictions.

Content

Scanner excerpt · INSTALL.md (reported line 81)May include surrounding context.

bash

curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY" \
  --data-urlencode 'q=固态电池' --data-urlencode 'size=5' \
  -G "https://api.ip930.com/api/search"

检索式里有中文和括号时，务必用 --data-urlencode -G，别手工拼 URL。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

This command sends authenticated patent lookup requests to an external service, again creating a channel for external transmission of user-requested content and credentials. In a skill that may be run by an agent on behalf of users, this is security-relevant because it normalizes off-platform transfer without clearly warning about third-party processing or constraining sensitive lookups.

Content

Scanner excerpt · INSTALL.md (reported line 90)May include surrounding context.

bash

curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY" \
  "https://api.ip930.com/api/patent?pn=CN109761224A"

各客户端

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

The MCP endpoint enables an agent platform to connect directly to a remote external service, broadening the attack surface from simple documentation examples to ongoing agent-mediated data transmission. In this context, the risk is higher because an MCP integration can operationalize repeated remote access and data sharing, potentially including user prompts, search terms, and derived analysis, without strong in-file safeguards or consent boundaries.

Content

Scanner excerpt · INSTALL.md (reported line 101)May include surrounding context.

其他 Agent 平台 — 只要能执行 shell 或发 HTTP 请求即可。

也可以走 MCP — 同一套数据提供 MCP 接入，端点 https://api.ip930.com/api/mcp（Streamable HTTP），支持 OAuth 2.1 一键授权：

json

{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The sample MCP configuration places a live bearer token directly in a configuration snippet, which encourages secret handling patterns that can lead to accidental credential exposure through copied config files, screenshots, logs, or repository commits. In agent environments, static header-based secret injection into config is especially risky because configs are often shared across tools and persisted on disk.

Content

Scanner excerpt · INSTALL.md (reported line 107)May include surrounding context.

md

{
  "mcpServers": {
    "patentmax": {
      "url": "https://api.ip930.com/api/mcp",
      "headers": { "Authorization": "Bearer pm_live_你的密钥" }
    }
  }

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This README presents all user-facing instructions and operational guidance only in Chinese, with no indication that users may choose another language. That creates a natural-language locale constraint that is not explicitly justified as region-specific or offered as an opt-in.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

The README states that no key is needed and that the first run will automatically claim a free trial and store credentials locally under ~/.patentmax/. This creates external transmission and implicit credential provisioning without an explicit opt-in step, which is risky in an AI-agent context because an agent may contact a third-party service and create/store tokens on the user's machine unexpectedly.

Content

Scanner excerpt · README.md (reported line 102)May include surrounding context.

不需要密钥，装上就能用。 第一次运行时脚本自动领取一份免费试用：累计 ¥40 额度、30 天有效，存在本机 ~/.patentmax/。

试用用完后，到 api.ip930.com/features/api-platform 注册（再送 ¥50），创建一个密钥，设成环境变量，设了就不再用试用：

bash

export PATENTMAX_API_KEY="pm_live_你的密钥"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 83% confidence

Finding

The skill advertises direct HTTP/MCP connectivity to a third-party endpoint and says any Bash-capable AI client can use it, increasing the chance an agent will transmit user queries, patent identifiers, or organization names to an external service. In this context, the danger is not the mere existence of a remote API, but that the skill normalizes outbound connections from agent environments without emphasizing consent, scope restriction, or data handling controls.

Content

Scanner excerpt · README.md (reported line 110)May include surrounding context.

md

完事了。没有配置文件要改，不用重启客户端——**任何能跑 Bash 的 AI 客户端都能用**。

> 同一套数据也提供 **MCP 接入**：端点 `https://api.ip930.com/api/mcp`，Streamable HTTP，支持 OAuth 2.1 一键授权，可直接接进 Claude、Cursor、扣子等兼容 Model Context Protocol 的客户端。这个 Skill 走 HTTP 接口是为了不挑客户端，两条路都通。

`scripts/patentmax_client.py` 只用 Python 标准库，不需要 `pip install`。环境里连 Python 都没有的话，直接 curl 也行，接口清单在 [references/api-reference.md](references/api-reference.md)。

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description says to use the skill whenever the user mentions broad topics like patent search, similar patents, citations, company portfolios, or even directly provides a patent number/publication number. This lacks clear boundaries or exclusion conditions, so ordinary discussion about patents could trigger the skill unintentionally.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

The skill instructs the agent to send user queries and potentially sensitive technical details to an external third-party API service. In this skill's context, users may provide unpublished inventions, formulations, parameters, or trade secrets; transmitting that data off-platform creates confidentiality and data-governance risk even if the transfer is functionally necessary for the service.

Content

Scanner excerpt · SKILL.md (reported line 673)May include surrounding context.

试用用完、过期，或想用其他功能（查新、交底书等）时，命令会返回带 "free_trial": true 的错误，message 里写着下一步怎么办（注册 PatentMax 再送 ¥50 体验额度），原样转告用户，不要自己换写法重试。

用户有自己的密钥时用环境变量传，避免写进命令历史；设了就一律用它，不会领试用。密钥在 api.ip930.com 控制台创建：

bash

export PATENTMAX_API_KEY="pm_live_你的密钥"

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill gives conflicting guidance on whether public patent websites may be used after PatentMax key failure: earlier it forbids switching to public web sources, while the later error-handling section offers that as an option after user choice. This inconsistency can cause agents to silently change data sources, weakening reproducibility and potentially mixing lower-assurance results into a report presented as if it came from the primary service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The markdown instructs the agent to relay the script's message verbatim and states that the message is user-facing Chinese text. This creates a language policy issue because it mandates a specific output language rather than offering to translate or match the user's language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Line L49 instructs users to switch languages in a fixed way (global database use Chinese, China database use English equivalents), which imposes a language/locale behavior rather than offering a choice. The file does not explain a user opt-in mechanism or clearly justify this as a region-specific constraint, so it creates a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file contains user-facing natural-language instructions exclusively in Chinese, and there is no indication that users can opt into another language or that the content is intentionally limited to a Chinese-speaking audience. Under the language/locale policy, forcing a specific language without user opt-in is a policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring states that errors and human-readable prompts are returned in Chinese, and the CLI help/messages throughout the file are also fixed in Chinese. For a general-purpose patent client, this imposes a locale choice on users without opt-in, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill description presents patent retrieval/analysis, but the code also auto-provisions and persists API credentials under the user's home directory. That is a hidden identity/credential-management behavior outside the obvious user expectation, which increases the attack surface and creates persistent secrets on disk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · INSTALL.md (reported line 9)May include surrounding context.

md

# 设了 PATENTMAX_API_KEY 就一律用它，不会去领试用。
TRIAL_SOURCE = "global-patent-search"
TRIAL_GROUP = "patent-search"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · INSTALL.md (reported line 73)May include surrounding context.

md

# 设了 PATENTMAX_API_KEY 就一律用它，不会去领试用。
TRIAL_SOURCE = "global-patent-search"
TRIAL_GROUP = "patent-search"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · INSTALL.md (reported line 136)May include surrounding context.

md

# 设了 PATENTMAX_API_KEY 就一律用它，不会去领试用。
TRIAL_SOURCE = "global-patent-search"
TRIAL_GROUP = "patent-search"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 16)May include surrounding context.

md

# 设了 PATENTMAX_API_KEY 就一律用它，不会去领试用。
TRIAL_SOURCE = "global-patent-search"
TRIAL_GROUP = "patent-search"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 48)May include surrounding context.

md

# 设了 PATENTMAX_API_KEY 就一律用它，不会去领试用。
TRIAL_SOURCE = "global-patent-search"
TRIAL_GROUP = "patent-search"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 73)May include surrounding context.

md

# 设了 PATENTMAX_API_KEY 就一律用它，不会去领试用。
TRIAL_SOURCE = "global-patent-search"
TRIAL_GROUP = "patent-search"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

Static analysis

No suspicious patterns detected.