ClawHub
Back to skill

Security audit

Office Action Response · PatentMax

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent PatentMax client for drafting Chinese patent office-action responses, but users should understand it uploads full patent materials to PatentMax and stores local task/API-key state.

Install only if you are comfortable sending full office-action, claims, specification, and related patent materials to PatentMax/api.ip930.com for processing, paying the stated fee after confirmation, and keeping a local trial/API key plus task records under ~/.patentmax. Confidential matters should be reviewed under your own client, firm, or company data-handling rules before use.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (18)

Tainted flow: 'req' from os.environ.get (line 192, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/patentmax_oa.py (reported line 126)May include surrounding context.

python
req.add_header("Content-Type", "application/json")
    req.add_header("Accept", "application/json")
    try:
        with urllib.request.urlopen(req, timeout=30) as response:
            payload = json.loads(response.read().decode("utf-8"))
    except urllib.error.HTTPError as exc:
        _, message = _server_error(exc.read().decode("utf-8", "replace"))

Tainted flow: 'req' from os.environ.get (line 192, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/patentmax_oa.py (reported line 199)May include surrounding context.

python
req.add_header("Content-Type", "application/json")
    for key, value in (headers or {}).items():
        req.add_header(key, value)
    return urllib.request.urlopen(req, timeout=TIMEOUT)


def request(path, method="GET", body=None, headers=None, raw=False):

Lp1

High
Category
MCP Least Privilege
Confidence
98% confidence
Finding

The code performs outbound network requests to a third-party API, including transmitting sensitive patent application and office-action contents, but the skill metadata does not declare network capability. This is dangerous because it hides external data transfer from the platform's permission model and from users who may assume the tool operates locally.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
98% confidence
Finding

The code performs outbound network requests to a third-party API, including transmitting sensitive patent application and office-action contents, but the skill metadata does not declare network capability. This is dangerous because it hides external data transfer from the platform's permission model and from users who may assume the tool operates locally.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README and skill description are presented only in Chinese, with no visible language choice, fallback, or opt-in. This can cause users who do not read Chinese to misunderstand the skill’s capabilities, pricing, document-handling behavior, and confirmation steps, increasing the risk of uninformed consent or accidental use.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill is presented as a drafting aid, but it also states that the system will automatically retrieve reference patents based on publication numbers in the office action. That expands the data flow and trust boundary beyond the local tool description, creating undisclosed external access and possible leakage of matter contents, cited documents, or user workflow metadata to a remote service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The markdown explicitly says the script's message is written for the user in Chinese, requiring the agent to relay it verbatim. This imposes a specific language on user-facing communication without presenting any language choice or documenting an opt-in, which matches the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest frames the skill as document drafting, but later discloses that user materials are sent to a server for processing. Because office-action responses and application materials may contain unpublished patent content, client identities, and confidential strategy, silent server-side transmission creates a significant confidentiality and data-handling risk if users are not clearly informed and given a choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The natural-language content throughout the file is presented only in Chinese, and there is no indication that users can opt into this language or that the skill is intentionally limited to a Chinese-language or China-specific workflow. Under the policy provided, forcing a specific language without user opt-in is a reportable natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

该文件中的自然语言指令明确要求“message 是给用户看的中文说明，AI 原样转述”，构成了对输出语言的硬性限定。虽然工具面向中国专利场景，但文件未向用户提供语言/locale 选择，也未把中文限制表述为用户可选项。

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is presented as a drafting aid, but it also automatically provisions and persists trial API credentials under ~/.patentmax without an explicit separate consent flow. That hidden account/credential lifecycle increases the attack surface and can surprise users in environments where local credential storage is sensitive or prohibited.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The tool sends data to an external service at api.ip930.com, which is a real external transmission of sensitive patent content and credentials. In this skill context, the transferred material can include unpublished patent application text and examination correspondence, so the confidentiality impact is substantial if users are not fully informed or if the endpoint is compromised or misconfigured.

Content

Scanner excerpt · scripts/patentmax_oa.py (reported line 87)May include surrounding context.

python
# 密钥版（TRIAL_SOURCE 为空）：必须设 PATENTMAX_API_KEY。
TRIAL_SOURCE = "office-action-response"
TRIAL_GROUP = "oa-response"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The code can obtain account-like API credentials from a remote service even though the core task is OA-response drafting. This mismatch is risky because it embeds account bootstrap behavior into a content-processing tool, enabling unanticipated credential creation and persistence during normal use.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This finding reflects integration with an external PatentMax service for registration and API-key use. While expected for a hosted client, it still represents off-box communication and should be treated as a security-relevant data flow because it affects user trust, data residency, and credential handling.

Content

Scanner excerpt · scripts/patentmax_oa.py (reported line 155)May include surrounding context.

python
if API_KEY:
        return API_KEY
    if not TRIAL_SOURCE:
        die("还没有设置 PatentMax 密钥。到 https://api.ip930.com/features/api-platform 注册（新用户送 ¥50 体验额度）"
            "并创建密钥，设成环境变量 PATENTMAX_API_KEY=pm_live_xxx 后，再运行同一条命令。", EXIT_INPUT)
    API_KEY = _load_trial_key() or _claim_trial_key()
    KEY_FROM_TRIAL = True

Ssd 3

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script explicitly instructs the AI to read unsupported source documents in full and convert them to text before submission. In this skill's context, that is dangerous because patent office actions and application files are highly sensitive legal documents, and requiring the model to extract and relay full contents expands disclosure risk and may cause unnecessary exposure of confidential material in chat history, logs, or downstream systems.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

L463 的说明要求将意见陈述书全文直接输出给用户，结合文件顶部和错误处理中的中文约束，整体行为默认以中文强制呈现。按规则，强制特定语言且无用户 opt-in 属于自然语言政策问题。

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/patentmax_oa.py (reported line 523)May include surrounding context.

python
die("对比文件最多给 10 篇；没给的系统会按通知书里的公开号自己去取。", EXIT_INPUT)
        body["input"]["cited_references"] = [cited_entry(p) for p in args.cited]
    if args.auto:
        body["input"]["auto_confirm"] = True
    if args.title:
        body["input"]["title_hint"] = args.title[:255]

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The stated purpose is to help draft Chinese patent office-action responses. Line L017 directs users to visit ip930.com and contact customer service for usage questions and enterprise procurement, which is a business/contact funnel rather than a capability needed to perform the drafting task.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.