ClawHub
Back to skill

Security audit

OA答复 · PatentMax

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate PatentMax Chinese patent OA drafting client, but it sends full confidential patent materials to a remote service with limited upfront disclosure.

Review before installing if the patent matter is unpublished, confidential, export-controlled, or client-sensitive. This skill sends full office actions, claims, specifications, and cited-reference material to PatentMax/ip930.com, may use or create an API key, stores local task/key files under ~/.patentmax, and can charge ¥15 per submitted task after confirmation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (19)

Tainted flow: 'req' from os.environ.get (line 192, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/patentmax_oa.py (reported line 126)May include surrounding context.

python
req.add_header("Content-Type", "application/json")
    req.add_header("Accept", "application/json")
    try:
        with urllib.request.urlopen(req, timeout=30) as response:
            payload = json.loads(response.read().decode("utf-8"))
    except urllib.error.HTTPError as exc:
        _, message = _server_error(exc.read().decode("utf-8", "replace"))

Tainted flow: 'req' from os.environ.get (line 192, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/patentmax_oa.py (reported line 199)May include surrounding context.

python
req.add_header("Content-Type", "application/json")
    for key, value in (headers or {}).items():
        req.add_header(key, value)
    return urllib.request.urlopen(req, timeout=TIMEOUT)


def request(path, method="GET", body=None, headers=None, raw=False):

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill admits near the end that materials will be sent to a server for processing, but this is omitted from the manifest despite the data including patent claims, specifications, and examination correspondence. That is sensitive confidential IP and legal-strategy material, so undisclosed exfiltration to a remote service materially changes the risk profile. The late disclosure makes inadvertent sharing more likely.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
98% confidence
Finding

The script performs network access to a third-party API, including uploading patent materials, but that capability is not covered by declared permissions. In an agent ecosystem this is security-relevant because undeclared egress can bypass user expectations and platform controls, especially when handling sensitive legal documents.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
98% confidence
Finding

The script performs network access to a third-party API, including uploading patent materials, but that capability is not covered by declared permissions. In an agent ecosystem this is security-relevant because undeclared egress can bypass user expectations and platform controls, especially when handling sensitive legal documents.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README is entirely framed around Chinese patent office responses and presents the skill as operating in Chinese, but it does not explicitly state that the locale restriction is intentional or offer any user opt-in for language/locale. Under the policy, forcing a specific language without user choice can be a natural-language policy violation unless the constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The description says to use the skill when the user says phrases like “帮我答复这份审查意见” and especially “这个 OA 怎么答”, which are natural conversational requests rather than tightly scoped invocation triggers. Although the domain is patent OA response, the file does not provide exclusion conditions or clear boundaries beyond examples, increasing the chance of over-broad matching.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill says it will draft an OA response, but it also instructs the agent to fetch comparison documents from a backend service. That is a material capability expansion because it causes external data retrieval and likely transmission beyond what the manifest clearly discloses. Users may provide confidential patent matter without understanding that remote service interactions are part of the workflow.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill embeds a paid submission and billing workflow even though the manifest presents the skill as a drafting aid. This mismatch can mislead users into triggering chargeable remote operations when they may expect only local document preparation. Hidden or under-disclosed monetization tied to tool execution is a security and trust risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The skill instructs the agent to pass the user's adjusted claim text downstream verbatim and without normalization. In a workflow that submits data to an external service, this removes opportunities to detect unsafe, malformed, or unintended content and increases the chance of accidental disclosure or prompt/command contamination in downstream processing. Legal text may need fidelity, but unrestricted pass-through still raises handling risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
71% confidence
Finding

The skill tells the agent to output the entire claims_text unchanged. While framed as a review step, this is still a plain-language instruction to disclose full task content wholesale, which can expose sensitive or proprietary material without any minimization step.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
74% confidence
Finding

The file directs the agent to reproduce statement_text in full, unchanged and unredacted. This is a natural-language instruction to expose complete generated content, potentially including sensitive case details, rather than applying least-necessary disclosure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The instructions state that the script's message is written for the user in Chinese and must be relayed verbatim. This forces a specific language for user communication, but the file does not provide a user opt-in or alternative language path, which is a locale-policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The docstring instructs that error messages are user-facing Chinese and should be relayed verbatim, which imposes a specific language on the interaction. The file does not offer the user any language or locale choice, nor does it document this as an explicit opt-in constraint.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/patentmax_oa.py (reported line 87)May include surrounding context.

python
# 密钥版（TRIAL_SOURCE 为空）：必须设 PATENTMAX_API_KEY。
TRIAL_SOURCE = "oa-response-cn"
TRIAL_GROUP = "oa-response"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/patentmax_oa.py (reported line 155)May include surrounding context.

python
# 密钥版（TRIAL_SOURCE 为空）：必须设 PATENTMAX_API_KEY。
TRIAL_SOURCE = "oa-response-cn"
TRIAL_GROUP = "oa-response"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

The --auto path enables automatic selection of the recommended strategy and automatic confirmation of amended claims, reducing meaningful human review in a sensitive legal drafting workflow. In patent prosecution, an incorrect autonomous choice can create legal prejudice, narrow claim scope, or submit arguments the user did not approve.

Content

Scanner excerpt · scripts/patentmax_oa.py (reported line 523)May include surrounding context.

python
die("对比文件最多给 10 篇；没给的系统会按通知书里的公开号自己去取。", EXIT_INPUT)
        body["input"]["cited_references"] = [cited_entry(p) for p in args.cited]
    if args.auto:
        body["input"]["auto_confirm"] = True
    if args.title:
        body["input"]["title_hint"] = args.title[:255]

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script collects full office actions, application text, and cited references, then submits them to a remote API without an explicit privacy or data-transfer warning at the point of use. Because patent prosecution materials may contain unpublished, commercially sensitive content, silent transmission to a third party materially increases confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The code accesses PATENTMAX_API_KEY from the environment to authenticate requests, which is a sensitive credential source. While this is functionally necessary, the file does not explicitly warn users that the skill consumes credentials from environment variables or advise safe handling.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.