发明人专利

• Outcome: Review
• Latest audit: Oct 20, 2026 · 10:54 AM UTC
• Version: 1.0.2

Overview

The advertised patent-search workflow is present, but API-key handling and cache file paths need security improvements.

Search details go to PatentMax and requests can consume account credit. Set a spending limit and avoid sending paid keys through chat. Before using a paid key, seek HTTPS and redirect safeguards, protected opt-in credential storage, and validated cache paths.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (35)

Tainted flow: 'req' from os.environ.get (line 138, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/patentmax_client.py (reported line 142)May include surrounding context.

python

req.add_header("Content-Type", "application/json")
    req.add_header("Accept", "application/json")
    try:
        with urllib.request.urlopen(req, timeout=30) as response:
            payload = json.loads(response.read().decode("utf-8"))
    except urllib.error.HTTPError as exc:
        message = _server_message(exc.read().decode("utf-8", "replace"))

Tainted flow: 'req' from os.environ.get (line 333, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 94% confidence

Finding

The client attaches its bearer key to an unrestricted environment-configured endpoint, including potentially plain HTTP endpoints. Additionally, urllib's default redirect handling can forward the explicitly added Authorization header to a different origin, exposing the key if an endpoint redirects to an attacker-controlled destination; ordinary authentication to the intended HTTPS API is not itself suspicious.

Content

Scanner excerpt · scripts/patentmax_client.py (reported line 344)May include surrounding context.

python

req.add_header(key, value)

    try:
        with urllib.request.urlopen(req, timeout=TIMEOUT) as response:
            payload = response.read()
            # 服务端每个响应都回本次实扣和扣完后的余额。记下来，供 _spent/_balance 输出。
            # 拿服务端的真值，而不是在本地累加估价：跨进程累加迟早算岔，

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Using an API credential could support patent searches, but printing part of that credential is not necessary to perform the declared functionality and exposes sensitive information. The supplied chunk performs no patent lookup, inventor disambiguation, or export. No network transmission is shown.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied code can support inventor searches through its generic query interface and returns inventor and applicant fields. However, its implemented scope is a broad patent-research toolkit, including distinct company-profiling and analytics functions not described in the declared purpose. Conversely, the key promised features—same-name disambiguation by organization and inventor-order marking—are not implemented in this chunk. Its Excel-compatible CSV export contains general candidate metadata, not inventor-specific fields. API authentication, billing controls, and caching are supporting implementation details and are not independently treated as mismatches.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The supplied workflow serves technical prior-art discovery rather than the declared inventor-portfolio lookup. Its search is driven by technical-feature keywords and a patent publication number, not an inventor's identity. The chunk contains no organization-based disambiguation, inventor-order identification, or list export. Although both workflows concern patents, the shown commands implement a materially different primary purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The supplied command explicitly selects the 'similar' operation with a patent number. This is a distinct search capability not described in the declared inventor-lookup purpose. The chunk provides no indication that this similarity search supports inventor identification, organization-based disambiguation, inventor ordering, or list export. The assessment is limited to the visible invocation; the client's internal behavior is not supplied.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The supplied commands demonstrate a broader patent-research toolkit rather than the declared inventor-listing workflow. Basic search and patent-detail retrieval could support inventor lookup, but semantic similarity, citation exploration, and report-figure export are distinct capabilities not disclosed in the description. The chunk also does not demonstrate inventor-name searches, organization-based disambiguation, inventor-order marking, or Excel-compatible list export. This assessment is limited to the visible commands; the referenced client's implementation is not supplied.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The supplied command searches a technology phrase, with no inventor name or inventor-specific constraint. Its demonstrated search behavior therefore differs from the declared inventor-focused purpose. Authentication and use of a patent search API are consistent supporting details, not independent mismatches. The chunk also does not demonstrate namesake separation, inventor-order identification, or export, though their absence alone would not establish a mismatch in a partial implementation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

The visible search selects patents by technical subject, not by inventor identity, so its immediate purpose differs from the declared inventor-specific lookup. It does not demonstrate organization-based namesake separation, inventor-order identification, or Excel-compatible export. Those omissions alone would not establish a mismatch in a partial code chunk; the substantive discrepancy is the explicitly topic-based search. No additional behavior of patentmax_client.py can be inferred from this command.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

Patent-detail retrieval could support inventor identification, so it is not independently treated as a mismatch. However, citation retrieval and similarity searching extend beyond the declared inventor-list workflow and can return patents unrelated to the named inventor. The supplied commands do not demonstrate inventor-name searching, organization-based disambiguation, inventor-order marking, or list export.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 86% confidence

Finding

The supplied command searches by battery and electrolyte keywords, with no inventor name or other person-specific constraint. Its visible search scope therefore differs materially from the declared inventor-focused purpose. The snippet does not show organization-based disambiguation, inventor-order identification, or export, although their absence alone is not the basis for this finding. The client's internal behavior is not supplied and cannot be assessed.

Content

No source excerpt is available for this finding.

Code capability 'env' detected in scripts/patentmax_client.py but not covered by declared permissions.

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'env' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.

Content

No source excerpt is available for this finding.

Code capability 'network' detected in scripts/patentmax_client.py but not covered by declared permissions.

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'network' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.

Content

No source excerpt is available for this finding.

The workflow sends user-provided inventor names and affiliations to PatentMax without explicitly disclosing that transmission.

Medium

• Category: Output Handling
• Confidence: 87% confidence

Finding

These steps instruct the agent to submit inventor names and organizational affiliations as search parameters to PatentMax. Although the skill identifies PatentMax as its data source and discloses query costs, it does not warn users that their supplied identifying details and search criteria will be sent to that third-party service.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 16)May include surrounding context.

bash

curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY" \
  "https://api.ip930.com/api/patent?pn=CN109761224A"

服务端自己完成内部寻址，这些前置调用不进用户账单。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 48)May include surrounding context.

服务端直接返回上次的结果、不再扣费；同一个键换了参数会被拒（400）；上一次还在处理中返回 409。

bash

curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY" -H "Idempotency-Key: task42-search-1"   "https://api.ip930.com/api/search?q=%E6%B5%B8%E6%B2%A1%E5%BC%8F%E6%B6%B2%E5%86%B7&ds=cn&size=20"

网络超时、不确定上一次有没有成功时，用同一个键重发，不要换键。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 73)May include surrounding context.

curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY"
--data-urlencode 'q=(固态电池 OR 全固态电池) AND 电解质'
--data-urlencode 'ds=all' --data-urlencode 'size=20'
-G "https://api.ip930.com/api/search"

text

> 检索式里有中文和括号，一定用 `--data-urlencode -G`，别手工拼 URL。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 89)May include surrounding context.

bash

curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY" \
  "https://api.ip930.com/api/patent?pn=CN109761224A"

某一块上游取不到时，该字段为 null 并在 unavailable 里列出，其余照常返回；

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 114)May include surrounding context.

bash

curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY" \
  "https://api.ip930.com/api/claims?pn=CN109761224A"

只要同时需要两块以上，就用 /api/patent——它一口价，拆开单买反而贵。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/faq.md (reported line 35)May include surrounding context.

md

- **密钥复制不全。** 前后有没有多余空格、有没有漏掉尾部字符
- **少了 `Bearer ` 前缀。** 用 curl 时 header 必须是 `Authorization: Bearer pm_live_xxx`，只写密钥不行
- **密钥被撤销了。** 到 [控制台](https://api.ip930.com/features/api-platform)看状态

> 还有个容易踩的：如果请求里带了 `Authorization` 头，URL 上的 `?apikey=` 就不会被读取。两种方式选一种，别混用——带了一个格式错误的 header，正确的 URL 参数也会被忽略。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/tools.md (reported line 668)May include surrounding context.

试用用完、过期，或想用其他功能（查新、交底书等）时，命令会返回带 "free_trial": true 的错误，message 里写着下一步怎么办（注册 PatentMax 再送 ¥50 体验额度），原样转告用户，不要自己换写法重试。

用户有自己的密钥时用环境变量传，避免写进命令历史；设了就一律用它，不会领试用。密钥在 api.ip930.com 控制台创建：

bash

export PATENTMAX_API_KEY="pm_live_你的密钥"

The search workflow does not warn users that queries derived from their technical proposals are sent to an external patent-search service.

Medium

• Category: Output Handling
• Confidence: 90% confidence

Finding

The workflow directs the agent to construct searches from a user's technical proposal and submit them through a patent-service client without a confidentiality check or disclosure that query content leaves the local environment. If the proposal contains unpublished invention details or trade secrets, distinctive query combinations could disclose sensitive information to the provider; this is more concerning because the advertised inventor-lookup task ordinarily needs names and organizations, not confidential technical details. The excerpt supports a workflow-level disclosure risk, but does not establish the client's actual destination or the provider's retention practices.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 124)May include surrounding context.

健康检查

bash

curl -s "https://api.ip930.com/api/v1/health"

不需要密钥，用来确认网络通不通。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/faq.md (reported line 41)May include surrounding context.

md

## 402 余额不足

到[控制台](https://api.ip930.com/features/api-platform)充值。

新账户的体验额度分两笔：注册送 ¥10，第一次调用成功后再送 ¥40。如果第二笔一直没到，确认第一次调用确实返回了 200——失败的调用不算。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/faq.md (reported line 119)May include surrounding context.

md

## 花了多少钱

脚本每次返回都带 `_spent`（本次实扣）和 `_balance`（余额），**这两个数来自服务端，是真值**。
准确的流水到[控制台](https://api.ip930.com/features/api-platform)查。

| 调用 | 单价 |
| --- | --- |