Invention Disclosure Writer · PatentMax

• Outcome: Review
• Latest audit: Oct 15, 2026 · 4:02 AM UTC
• Version: 1.1.3

Overview

The skill appears purpose-built for patent disclosure generation, but it uploads sensitive invention/R&D material to an external service with limited scoping and privacy detail.

Review before installing if you may submit confidential, unpublished, export-controlled, customer, or employer-owned invention material. Only run it when you are authorized to send the material to PatentMax/api.ip930.com, understand that content and generated documents are processed remotely, and have verified the environment is not overriding PATENTMAX_BASE_URL to another server.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (27)

Tainted flow: 'req' from os.environ.get (line 221, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The script builds outbound requests using a base URL taken from PATENTMAX_BASE_URL and then sends API requests, including sensitive invention disclosure content and API credentials, to that endpoint. Because the endpoint is fully environment-configurable and not allowlisted or validated, a hostile host or wrapper can redirect traffic to an attacker-controlled server and exfiltrate proprietary data and bearer tokens.

Content

Scanner excerpt · scripts/patentmax_disclosure.py (reported line 145)May include surrounding context.

python

req.add_header("Content-Type", "application/json")
    req.add_header("Accept", "application/json")
    try:
        with urllib.request.urlopen(req, timeout=30) as response:
            payload = json.loads(response.read().decode("utf-8"))
    except urllib.error.HTTPError as exc:
        _, message = _server_error(exc.read().decode("utf-8", "replace"))

Tainted flow: 'req' from os.environ.get (line 221, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 98% confidence

Finding

All core report operations use urllib.request.urlopen on requests whose destination is derived from PATENTMAX_BASE_URL, while the request body may contain confidential R&D documents, idea text, and downloaded report artifacts. This creates a clear exfiltration path if the environment variable is manipulated, especially in an agent/skill setting where the runtime environment may not be controlled by the end user.

Content

Scanner excerpt · scripts/patentmax_disclosure.py (reported line 230)May include surrounding context.

python

req.add_header(key, value)

    try:
        with urllib.request.urlopen(req, timeout=TIMEOUT) as response:
            payload = response.read()
            return payload if raw else json.loads(payload.decode("utf-8"))
    except urllib.error.HTTPError as exc:

Lp1

High

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The script performs network access to external services for trial-key issuance, report submission, polling, and document download, yet this capability is reportedly undeclared. In a skill ecosystem, undeclared outbound network access is a real risk because it can transmit sensitive user IP and documents outside expected trust boundaries without operator review.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The script performs network access to external services for trial-key issuance, report submission, polling, and document download, yet this capability is reportedly undeclared. In a skill ecosystem, undeclared outbound network access is a real risk because it can transmit sensitive user IP and documents outside expected trust boundaries without operator review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README encourages users to provide design documents, R&D reports, experiment records, or even an entire project directory so the service can generate a patent disclosure, but it does not clearly warn that these materials may be transmitted to an external patent service. In this context, the uploaded content is likely to contain highly sensitive trade secrets, unpublished inventions, source code, and regulated technical data, so lack of explicit disclosure and consent guidance creates a real confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

The README explicitly directs users to register for an API key at an external domain and strongly implies that the skill relies on remote PatentMax services. External transmission is expected for this product, but the security issue is that the documentation surfaces the external endpoint without adjacent, clear disclosure of what user content is uploaded and what security/privacy guarantees apply, which is especially risky for patent and R&D material.

Content

Scanner excerpt · README.md (reported line 59)May include surrounding context.

不需要密钥，装上就能用。 第一次运行时脚本自动领取一份免费试用：累计 ¥40 额度、30 天有效，存在本机 ~/.patentmax/。

试用用完后，在 api.ip930.com 注册（再送 ¥50 体验额度）并创建密钥，设成环境变量即可，设了就不再用试用：

bash

export PATENTMAX_API_KEY="pm_live_你的密钥"

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The description states that all models used are domestic Chinese models and that foreign models are not used. This imposes a language/locale/technology-origin policy choice on the user without presenting it as an option or obtaining opt-in, which matches the policy-violation category for forced locale-related constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The markdown reiterates that only domestic Chinese models are used and no foreign models are used. As written, this is a fixed locale/technology-origin constraint with no user choice and no stated compliance justification, so it qualifies as a natural-language policy concern.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/faq.md (reported line 7)May include surrounding context.

md

| 现象 | 处理 |
| --- | --- |
| `免费试用额度已用完` / `免费试用只开通了……` | 免费试用的额度用完了，或者想用别的功能。注册 PatentMax 再送 ¥50 体验额度，创建密钥后 `export PATENTMAX_API_KEY=pm_live_xxx`：https://api.ip930.com/features/api-platform |
| `免费试用密钥已过期或失效` | 本地缓存已自动清掉，重跑同一条命令会领新的；或者换成正式密钥 |
| `HTTP 401` | 密钥无效或已撤销，到控制台重新创建 |
| `HTTP 402` | 余额不足，到控制台充值 |

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/faq.md (reported line 75)May include surrounding context.

md

| 现象 | 处理 |
| --- | --- |
| `免费试用额度已用完` / `免费试用只开通了……` | 免费试用的额度用完了，或者想用别的功能。注册 PatentMax 再送 ¥50 体验额度，创建密钥后 `export PATENTMAX_API_KEY=pm_live_xxx`：https://api.ip930.com/features/api-platform |
| `免费试用密钥已过期或失效` | 本地缓存已自动清掉，重跑同一条命令会领新的；或者换成正式密钥 |
| `HTTP 401` | 密钥无效或已撤销，到控制台重新创建 |
| `HTTP 402` | 余额不足，到控制台充值 |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The FAQ includes ready-to-run curl examples that send patent disclosure materials and idea text to a third-party remote API, but it does not prominently warn that highly sensitive R&D, trade secret, or pre-filing invention data will leave the local environment and be processed externally. In a patent-disclosure skill, this omission is especially risky because users may paste confidential invention details without understanding the privacy, retention, and ownership implications.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The URL is part of a concrete upload command that sends technical disclosure data to an external endpoint. In this skill context, the combination of sensitive invention content and missing privacy caveats makes the transmission security-relevant.

Content

Scanner excerpt · references/faq.md (reported line 60)May include surrounding context.

bash

# 提交交底书
curl -s -X POST "https://api.ip930.com/api/v1/reports" \
  -H "Authorization: Bearer $PATENTMAX_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 任取一个唯一串" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The URL is part of a concrete upload command that sends technical disclosure data to an external endpoint. In this skill context, the combination of sensitive invention content and missing privacy caveats makes the transmission security-relevant.

Content

Scanner excerpt · references/faq.md (reported line 60)May include surrounding context.

bash

# 提交交底书
curl -s -X POST "https://api.ip930.com/api/v1/reports" \
  -H "Authorization: Bearer $PATENTMAX_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 任取一个唯一串" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This command sends raw idea text to a remote API for 'idea upgrade' processing. Idea text can itself contain patentable concepts or trade secrets, so exposing it without warning may lead users to unintentionally disclose valuable intellectual property.

Content

Scanner excerpt · references/faq.md (reported line 67)May include surrounding context.

md

-d '{"report_type":"technical_disclosure","input":{"supplement":"材料正文……","title_hint":"案件名称"}}'

# 出方向
curl -s -X POST "https://api.ip930.com/api/v1/reports" \
  -H "Authorization: Bearer $PATENTMAX_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 任取一个唯一串" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Fetching the generated report from the external service retrieves processed disclosure content that may still be highly confidential. Although this is retrieval rather than submission, it confirms that sensitive patent-related material resides on a third-party system and is accessed over external API calls.

Content

Scanner excerpt · references/faq.md (reported line 79)May include surrounding context.

md

# 取结果
curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY" \
  "https://api.ip930.com/api/v1/reports/<report_id>"

# 下载交底书 / 核对说明
curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY" -o 技术交底书.docx \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Downloading the disclosure document from a remote API shows that full patent-related content is hosted externally. In this context, the risk is not malicious code execution but unannounced third-party storage and transfer of sensitive IP artifacts.

Content

Scanner excerpt · references/faq.md (reported line 83)May include surrounding context.

下载交底书 / 核对说明

curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY" -o 技术交底书.docx
"https://api.ip930.com/api/v1/reports/<report_id>/files/report.docx" curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY" -o 核对说明.docx
"https://api.ip930.com/api/v1/reports/<report_id>/files/report.docx?kind=notes"

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 79% confidence

Finding

The notes document likely contains inferred gaps, interpretations, and technical details derived from the user's invention materials, and it is also downloaded from the third-party service. This reinforces the external handling of confidential IP without adequate warning in the documentation.

Content

Scanner excerpt · references/faq.md (reported line 85)May include surrounding context.

curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY" -o 技术交底书.docx
"https://api.ip930.com/api/v1/reports/<report_id>/files/report.docx" curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY" -o 核对说明.docx
"https://api.ip930.com/api/v1/reports/<report_id>/files/report.docx?kind=notes"

text

**`Idempotency-Key` 必填。** 同一个键重试不会重复扣费，但同一个键配不同的材料会被拒绝。

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide explicitly states that materials are sent to a server and that generation is unattended, but it does not present a clear upfront privacy/security warning before encouraging users to provide detailed R&D, patent, and potentially trade-secret information. In this skill context, that is meaningful because users are likely to submit highly sensitive unpublished invention details, so inadequate notice can lead to unintended disclosure or privacy/compliance issues.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The entire skill guidance is written as mandatory Chinese-language user interaction, including instructions like '跟用户说清' and how to present results to the user, but it does not offer any language or locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/patentmax_disclosure.py (reported line 11)May include surrounding context.

python

**每条命令最多跑 30 秒就返回。** WorkBuddy 这类宿主前台跑命令时，要等命令结束才显示输出，
AI 中途也插不了话；一条命令阻塞十几分钟，用户就十几分钟什么都看不到，宿主还可能把命令掐掉。
所以 create / ideas 提交后只等 15 秒就先返回，之后用 wait 接着等，每次最多 30 秒：

    退出码 0   这一步有结果了（wait 完成时已自动下载好 Word）
    退出码 10  还在生成：把输出里的「[进度]」行告诉用户，再运行一次 wait

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/patentmax_disclosure.py (reported line 11)May include surrounding context.

python

**每条命令最多跑 30 秒就返回。** WorkBuddy 这类宿主前台跑命令时,要等命令结束才显示输出,
AI 中途也插不了话;一条命令阻塞十几分钟,用户就十几分钟什么都看不到,宿主还可能把命令掐掉。
所以 create / ideas 提交后只等 15 秒就先返回,之后用 wait 接着等,每次最多 30 秒:

    退出码 0   这一步有结果了(wait 完成时已自动下载好 Word)
    退出码 10  还在生成:把输出里的「[进度]」行告诉用户,再运行一次 wait

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description claims all models are domestic/Chinese-only, but the code only uses a configurable API endpoint and does not technically enforce that guarantee. This is a trust and data-governance vulnerability: users may provide sensitive patent disclosures relying on that representation, while a changed base URL could route data elsewhere.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

该注释明确要求“message 是给用户看的中文说明，AI 原样转述”，构成了语言/locale 的硬性约束。文件其余多处用户可见文案也全部固定为中文，但这里最明确地把中文设为必须，且没有提供用户选择或 opt-in。

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The code is explicitly designed to transmit user content and metadata to the external domain api.ip930.com to obtain trial keys and use the report-generation service. In the context of an invention-disclosure skill, that means highly sensitive intellectual-property material leaves the local environment, making external transmission security-relevant and potentially high consequence for users.

Content

Scanner excerpt · scripts/patentmax_disclosure.py (reported line 103)May include surrounding context.

python

# 密钥版（TRIAL_SOURCE 为空）：必须设 PATENTMAX_API_KEY，不领试用。
TRIAL_SOURCE = "invention-disclosure-writer"
TRIAL_GROUP = "disclosure"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The script instructs users to register for and use an external PatentMax API service, and later submits invention materials to that service. Because the skill processes patent disclosures, the external transfer of confidential R&D content is inherently sensitive and should be treated as a real security/privacy risk, not a harmless implementation detail.

Content

Scanner excerpt · scripts/patentmax_disclosure.py (reported line 182)May include surrounding context.

python

if API_KEY:
        return API_KEY
    if not TRIAL_SOURCE:
        die("还没有设置 PatentMax 密钥。到 https://api.ip930.com/features/api-platform 注册（新用户送 ¥50 体验额度）"
            "并创建密钥，设成环境变量 PATENTMAX_API_KEY=pm_live_xxx 后，再运行同一条命令。", EXIT_INPUT)
    API_KEY = _load_trial_key() or _claim_trial_key()
    KEY_FROM_TRIAL = True

Static analysis

No suspicious patterns detected.