Security audit

专利申请人查询

Security checks for vulnerabilities and agentic risk

Overview

The patent lookup workflow is coherent, but weaknesses in API-key protection and file handling warrant review before use.

Have the publisher fix credential routing and cache-path validation before using a paid key or running alongside sensitive files. Searches go to PatentMax and may incur charges. Treat the name list as potentially incomplete because statistics return only the top 20 names.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (40)

Tainted flow: 'req' from os.environ.get (line 138, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/patentmax_client.py (reported line 142)May include surrounding context.
python
req.add_header("Content-Type", "application/json") req.add_header("Accept", "application/json") try: with urllib.request.urlopen(req, timeout=30) as response: payload = json.loads(response.read().decode("utf-8")) except urllib.error.HTTPError as exc: message = _server_message(exc.read().decode("utf-8", "replace"))

Tainted flow: 'req' from os.environ.get (line 333, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 95% confidence
Finding: The client attaches its loaded bearer key to any PATENTMAX_BASE_URL without checking the destination or requiring HTTPS. An attacker who can influence that configuration can capture an existing paid API key, and the default urllib redirect handling can also forward the Authorization header to a different origin; authentication to the intended patent service is legitimate, but these destination boundaries are not enforced.
Content: Scanner excerpt · scripts/patentmax_client.py (reported line 344)May include surrounding context.
python
req.add_header(key, value) try: with urllib.request.urlopen(req, timeout=TIMEOUT) as response: payload = response.read() # 服务端每个响应都回本次实扣和扣完后的余额。记下来，供 _spent/_balance 输出。 # 拿服务端的真值，而不是在本地累加估价：跨进程累加迟早算岔，

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The supplied code is a broad patent-research client, not the specialized company applicant-name discovery tool described. Search results and applicant statistics could support that workflow, but applicant statistics are explicitly limited to the top 20 entries and do not normalize corporate groups. No dedicated logic discovers all company-name variants or produces the promised consolidated query and name table. Credential handling, caching, and budgeting are supporting implementation details; the material mismatch is the broader substantive functionality and the absence of the declared specialized workflow in this chunk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The supplied shell command exposes part of an API key rather than performing patent applicant research or generating the declared outputs. Although accessing an API key could support patent API authentication, printing its contents is an undeclared credential-disclosure behavior, not a necessary authentication step.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The supplied commands perform document-level research on a fixed patent rather than company applicant-name discovery. They show no applicant-name enumeration, subsidiary or former-name resolution, name-variant counts, table export, or applicant-query construction. The declared purpose does not explain these distinct patent-research operations, and the supplied chunk does not establish them as supporting steps.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The supplied commands implement a technical prior-art discovery workflow: search by invention features, select the closest patent, and retrieve similar patents. Although both the description and code concern patents, this is materially different from resolving company applicant identities and constructing an applicant query. The chunk shows no company-name expansion, subsidiary or former-name discovery, applicant counts, or Excel-compatible applicant-name output.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The chunk exposes a patent-screening workflow, including selection decisions based on cooling-fluid relevance. This is materially different from identifying company applicant names and constructing an applicant query. Although both workflows concern patents and spreadsheet-compatible exports, the supplied commands show no applicant-name enumeration, variant handling, subsidiary-name discovery, or applicant-query generation. This assessment is limited to the supplied chunk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The supplied command performs a similar-patent search. It does not identify a company’s applicant names, subsidiaries, naming variants, or former names, and does not request applicant counts, a name table, or an applicant query. No connection is shown that would establish this similarity search as a supporting step for the declared workflow.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: General patent search could support applicant-name discovery and is not itself a mismatch. However, semantic similarity, citation analysis, full-text retrieval, and figure export materially broaden the capability beyond the declared applicant-name lookup and query-building purpose. The supplied chunk does not demonstrate name-variant enumeration, subsidiary coverage, applicant counts, or Excel-compatible table generation. These are documented command examples rather than evidence that the commands were executed.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The supplied request targets patent claims, not applicant identities, corporate relationships, name variants, or counts. Nothing in the chunk connects this claims retrieval to the declared applicant-name workflow. The API authentication itself is a supporting implementation detail, not the mismatch.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The supplied command searches for '(固态电池 OR 全固态电池) AND 电解质' without a company or applicant-name constraint. It does not discover applicant aliases, subsidiaries, former names, or case and bracket variants, nor generate the promised table or applicant query. API authentication is a supporting implementation detail, not itself a mismatch. This assessment is limited to the supplied reference command.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The supplied command searches for solid-state battery and electrolyte patents without any company or applicant constraint. It does not demonstrate applicant-name expansion, subsidiary or former-name discovery, name-specific counts, or the promised outputs. Although patent searching could support the declared workflow, this standalone topical search has no visible connection to applicant-name identification and therefore represents a materially different task. This assessment is limited to the supplied code chunk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The supplied command contains no company or applicant-name criteria and instead searches for patents on a predetermined technical topic. This materially differs from the declared applicant-name discovery purpose. JSON output alone is not a mismatch, since it could be an intermediate implementation detail; the mismatch is the unrelated search objective. The client implementation is not supplied, so no additional behavior is inferred.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The supplied request searches a technology term without any company or applicant-name criteria. It does not demonstrate applicant-name discovery, subsidiary resolution, variant enumeration, counts, table export, or applicant-query construction. Although calling a patent API could support the declared purpose, this specific request has a materially different search target. The authorization header is an ordinary API implementation detail and is not itself evidence of a mismatch.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 86% confidence
Finding: The supplied command targets one specific patent and requests a brief. It contains no company lookup, applicant-name expansion, counting, table export, or applicant-query construction. Although patent retrieval could support the declared workflow, the supplied chunk does not establish that connection and instead performs a materially different operation. The client implementation is not supplied, so no additional behavior is inferred.
Content: No source excerpt is available for this finding.

Code capability 'env' detected in scripts/patentmax_client.py but not covered by declared permissions.

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'env' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.
Content: No source excerpt is available for this finding.

Code capability 'network' detected in scripts/patentmax_client.py but not covered by declared permissions.

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'network' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.
Content: No source excerpt is available for this finding.

The workflow sends user-supplied company names and applicant queries to PatentMax without a privacy disclosure.

Medium

Category: Output Handling
Confidence: 88% confidence
Finding: These steps instruct the agent to submit company names and constructed applicant queries to PatentMax. Although the skill identifies PatentMax as the data source and requires a cost notice, it does not warn that the user's research targets will be transmitted to a third-party service.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api-reference.md (reported line 16)May include surrounding context.
bash
curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY" \ "https://api.ip930.com/api/patent?pn=CN109761224A"

服务端自己完成内部寻址，这些前置调用不进用户账单。

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api-reference.md (reported line 48)May include surrounding context.
服务端直接返回上次的结果、不再扣费；同一个键换了参数会被拒（400）；上一次还在处理中返回 409。

bash
curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY" -H "Idempotency-Key: task42-search-1" "https://api.ip930.com/api/search?q=%E6%B5%B8%E6%B2%A1%E5%BC%8F%E6%B6%B2%E5%86%B7&ds=cn&size=20"

网络超时、不确定上一次有没有成功时，用同一个键重发，不要换键。

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api-reference.md (reported line 73)May include surrounding context.
curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY"
--data-urlencode 'q=(固态电池 OR 全固态电池) AND 电解质'
--data-urlencode 'ds=all' --data-urlencode 'size=20'
-G "https://api.ip930.com/api/search"

text
> 检索式里有中文和括号，一定用 `--data-urlencode -G`，别手工拼 URL。

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api-reference.md (reported line 89)May include surrounding context.
bash
curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY" \ "https://api.ip930.com/api/patent?pn=CN109761224A"

某一块上游取不到时，该字段为 null 并在 unavailable 里列出，其余照常返回；

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api-reference.md (reported line 114)May include surrounding context.
bash
curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY" \ "https://api.ip930.com/api/claims?pn=CN109761224A"

只要同时需要两块以上，就用 /api/patent——它一口价，拆开单买反而贵。

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/faq.md (reported line 35)May include surrounding context.
md
- **密钥复制不全。** 前后有没有多余空格、有没有漏掉尾部字符 - **少了 `Bearer ` 前缀。** 用 curl 时 header 必须是 `Authorization: Bearer pm_live_xxx`，只写密钥不行 - **密钥被撤销了。** 到 [控制台](https://api.ip930.com/features/api-platform)看状态 > 还有个容易踩的：如果请求里带了 `Authorization` 头，URL 上的 `?apikey=` 就不会被读取。两种方式选一种，别混用——带了一个格式错误的 header，正确的 URL 参数也会被忽略。

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/faq.md (reported line 41)May include surrounding context.
md
## 402 余额不足到[控制台](https://api.ip930.com/features/api-platform)充值。新账户的体验额度分两笔：注册送 ¥10，第一次调用成功后再送 ¥40。如果第二笔一直没到，确认第一次调用确实返回了 200——失败的调用不算。