Security audit

职务发明奖励

Security checks for vulnerabilities and agentic risk

Overview

The award-report workflow fits its purpose, but weak API-key protections and cache-path handling warrant review.

Before supplying a paid key, seek HTTPS destination restrictions, safe redirect handling, and cache-path containment. Use a limited service key supplied outside chat. Company names and search criteria go to PatentMax; keep internal reward policies local and agree on query costs. Review the generated amounts before using them for payments.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (39)

Tainted flow: 'req' from os.environ.get (line 138, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/patentmax_client.py (reported line 142)May include surrounding context.
python
req.add_header("Content-Type", "application/json") req.add_header("Accept", "application/json") try: with urllib.request.urlopen(req, timeout=30) as response: payload = json.loads(response.read().decode("utf-8")) except urllib.error.HTTPError as exc: message = _server_message(exc.read().decode("utf-8", "replace"))

Tainted flow: 'req' from os.environ.get (line 333, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 94% confidence
Finding: Sending the API key to the intended PatentMax service is legitimate, but this client attaches it to any configured BASE_URL without enforcing HTTPS or an approved destination. Python's default urllib redirect handling can also carry this Authorization header to another origin, allowing an attacker-controlled endpoint or redirect to obtain a paid API credential.
Content: Scanner excerpt · scripts/patentmax_client.py (reported line 344)May include surrounding context.
python
req.add_header(key, value) try: with urllib.request.urlopen(req, timeout=TIMEOUT) as response: payload = response.read() # 服务端每个响应都回本次实扣和扣完后的余额。记下来，供 _spent/_balance 输出。 # 拿服务端的真值，而不是在本地累加估价：跨进程累加迟早算岔，

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The supplied command exposes part of an API key rather than performing patent counting, award calculation, or report generation. Although API authentication could support the declared purpose, printing credential characters is not authentication and is an undeclared disclosure behavior. The chunk does not show external transmission.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The supplied commands implement a technical patent-search workflow, not an inventor-award reporting workflow. They neither filter grants by year nor aggregate inventors, calculate awards, or produce reward reports. Although patent retrieval could support the declared purpose, these particular searches are driven by technical similarity rather than the grant and inventor data needed for award statistics.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: There is some supporting overlap: patent searches return inventor metadata, and the statistics endpoint can aggregate by inventor. However, the supplied chunk is primarily a broad patent-research client, not an invention-award reporting implementation. Its inventor statistics are limited to the top 20 results, and it contains no award calculation rules or person-level reporting logic. External API access, credential storage, caching, and billing controls can be supporting implementation details and are not, by themselves, the basis for this finding. The mismatch is the materially broader research functionality and absence of the declared core reporting and calculation behavior in this chunk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 所示命令主要用于候选专利筛选管理，其中明确按水基冷却液与数据中心机柜结构等技术主题进行取舍。这不同于声明的年度授权专利、发明人数量和奖励金额统计。虽然两者都涉及专利且可导出 Excel 可读文件，但该代码未展示年度授权筛选、发明人汇总或奖励计算，且修改候选专利取舍状态属于未声明的能力。
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The supplied command searches for patents similar to a fixed patent rather than identifying yearly grants, counting inventors’ patents, calculating awards, or exporting award summaries. No connection to the declared award-accounting workflow is evident in this code chunk. The client’s internal implementation and any network access are not shown.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The supplied commands implement a patent research workflow rather than inventor award accounting. Retrieving patent details could support identifying inventors, but citation retrieval and similarity searching are not explained by the declared purpose. The chunk shows no year-based grant filtering, inventor aggregation, award calculation, or spreadsheet output.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The supplied command performs a subject-matter patent search, without filtering for the relevant grant year, identifying corporate inventors, aggregating inventor counts, calculating awards, or generating reports. Patent retrieval could support the declared workflow, but this hardcoded technology query has no demonstrated connection to that workflow. The mismatch is the unrelated search behavior, not the use of an authenticated external API itself.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: Patent searches and bibliographic retrieval could support identifying eligible grants and inventors, so those alone would not establish a mismatch. However, the supplied chunk describes a broader patent-research toolkit, including similarity analysis, citations, and report illustrations, without connecting those capabilities to inventor rewards. These are substantive capabilities outside the declared purpose. The chunk contains command examples rather than the client implementation, so underlying execution details cannot be verified.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: Patent retrieval could support the declared workflow, but this command searches a fixed technical subject rather than patents associated with a company, grant year, or inventor-award calculation. The supplied chunk shows no grant-year filtering, inventor aggregation, award computation, or spreadsheet output. The mismatch is the unrelated hard-coded search objective, not merely the absence of the rest of the workflow. The underlying client's implementation is not supplied, so no additional behavior is inferred.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: Patent retrieval could support award reporting, but this command performs a fixed technical-topic search without any visible connection to a company, grant year, inventor counts, or award calculations. The supplied chunk therefore demonstrates a materially different operation from the declared purpose. No behavior beyond the visible command is assumed.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: Patent-data retrieval could support the declared workflow, but this request specifically targets claims for a hard-coded publication. Claims content has no evident role in counting annual grants or calculating inventor awards. The supplied chunk therefore accesses a materially different resource and shows no connection to the declared reporting workflow. This assessment is limited to the supplied chunk.
Content: No source excerpt is available for this finding.

Code capability 'env' detected in scripts/patentmax_client.py but not covered by declared permissions.

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'env' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.
Content: No source excerpt is available for this finding.

Code capability 'network' detected in scripts/patentmax_client.py but not covered by declared permissions.

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'network' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.
Content: No source excerpt is available for this finding.

The workflow sends user-provided company names to PatentMax without explicitly disclosing that external transmission.

Medium

Category: Output Handling
Confidence: 86% confidence
Finding: The workflow instructs the agent to submit applicant searches containing the company and subsidiary names collected from the user. Although the skill identifies PatentMax as its data source and explains query costs, it does not tell users that their supplied company names and search criteria will be transmitted to that third-party service.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api-reference.md (reported line 16)May include surrounding context.
bash
curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY" \ "https://api.ip930.com/api/patent?pn=CN109761224A"

服务端自己完成内部寻址，这些前置调用不进用户账单。

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api-reference.md (reported line 89)May include surrounding context.
bash
curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY" \ "https://api.ip930.com/api/patent?pn=CN109761224A"

某一块上游取不到时，该字段为 null 并在 unavailable 里列出，其余照常返回；

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api-reference.md (reported line 114)May include surrounding context.
bash
curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY" \ "https://api.ip930.com/api/claims?pn=CN109761224A"

只要同时需要两块以上，就用 /api/patent——它一口价，拆开单买反而贵。

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/faq.md (reported line 35)May include surrounding context.
md
- **密钥复制不全。** 前后有没有多余空格、有没有漏掉尾部字符 - **少了 `Bearer ` 前缀。** 用 curl 时 header 必须是 `Authorization: Bearer pm_live_xxx`，只写密钥不行 - **密钥被撤销了。** 到 [控制台](https://api.ip930.com/features/api-platform)看状态 > 还有个容易踩的：如果请求里带了 `Authorization` 头，URL 上的 `?apikey=` 就不会被读取。两种方式选一种，别混用——带了一个格式错误的 header，正确的 URL 参数也会被忽略。

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api-reference.md (reported line 48)May include surrounding context.
服务端直接返回上次的结果、不再扣费；同一个键换了参数会被拒（400）；上一次还在处理中返回 409。

bash
curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY" -H "Idempotency-Key: task42-search-1" "https://api.ip930.com/api/search?q=%E6%B5%B8%E6%B2%A1%E5%BC%8F%E6%B6%B2%E5%86%B7&ds=cn&size=20"

网络超时、不确定上一次有没有成功时，用同一个键重发，不要换键。

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api-reference.md (reported line 73)May include surrounding context.
curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY"
--data-urlencode 'q=(固态电池 OR 全固态电池) AND 电解质'
--data-urlencode 'ds=all' --data-urlencode 'size=20'
-G "https://api.ip930.com/api/search"

text
> 检索式里有中文和括号，一定用 `--data-urlencode -G`，别手工拼 URL。

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/faq.md (reported line 41)May include surrounding context.
md
## 402 余额不足到[控制台](https://api.ip930.com/features/api-platform)充值。新账户的体验额度分两笔：注册送 ¥10，第一次调用成功后再送 ¥40。如果第二笔一直没到，确认第一次调用确实返回了 200——失败的调用不算。

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/faq.md (reported line 119)May include surrounding context.
md
## 花了多少钱脚本每次返回都带 `_spent`（本次实扣）和 `_balance`（余额），**这两个数来自服务端，是真值**。准确的流水到[控制台](https://api.ip930.com/features/api-platform)查。 | 调用 | 单价 | | --- | --- |

The workflow invokes paid technical-analysis capabilities unrelated to inventor reward statistics.

Medium

Category: Excessive Agency
Confidence: 94% confidence
Finding: The manifest limits the skill to counting granted patents, identifying inventors, and calculating awards. L036–L038 instead instruct execution of full-text retrieval, citation analysis, and semantic-similarity searches, with L046–L060 extending the workflow to infringement obstacles, competitor benchmarking, and novelty assessment; these are separate patent-analysis tasks, and the document explicitly identifies associated charges.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.