专利引证分析

• Outcome: Review
• Latest audit: Oct 19, 2026 · 7:45 AM UTC
• Version: 1.0.0

Overview

This appears to be a real PatentMax patent-analysis skill, but it needs review because it can send patent queries and API credentials to a configurable external endpoint and includes broader patent-search workflows than its citation-focused description suggests.

Install only if you are comfortable sending patent numbers, search terms, and technical descriptions to PatentMax/ip930.com. Do not use it with confidential invention details unless that third-party disclosure is acceptable, and avoid setting PATENTMAX_BASE_URL unless you deliberately control and trust the endpoint.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (35)

Tainted flow: 'req' from os.environ.get (line 307, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/patentmax_client.py (reported line 118)May include surrounding context.

python

req.add_header("Content-Type", "application/json")
    req.add_header("Accept", "application/json")
    try:
        with urllib.request.urlopen(req, timeout=30) as response:
            payload = json.loads(response.read().decode("utf-8"))
    except urllib.error.HTTPError as exc:
        message = _server_message(exc.read().decode("utf-8", "replace"))

Tainted flow: 'req' from os.environ.get (line 307, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 91% confidence

Finding

The generic request() path sends the Authorization bearer token to whatever host is in PATENTMAX_BASE_URL, which is environment-controlled. If an attacker can influence the runtime environment, they can redirect requests to an attacker-controlled server and capture the API key and all patent queries/results. In this skill context, network access is expected, but unrestricted destination override makes credential exfiltration and data redirection materially more dangerous.

Content

Scanner excerpt · scripts/patentmax_client.py (reported line 318)May include surrounding context.

python

req.add_header(key, value)

    try:
        with urllib.request.urlopen(req, timeout=TIMEOUT) as response:
            payload = response.read()
            # 服务端每个响应都回本次实扣和扣完后的余额。记下来，供 _spent/_balance 输出。
            # 拿服务端的真值，而不是在本地累加估价：跨进程累加迟早算岔，

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

声明将该技能定位为“专利引证分析”工具，聚焦前向/后向引证及相似专利补缺；而代码实际实现的是一个多功能专利数据 CLI，覆盖检索、全文读取、统计、企业画像、附图下载、预算管理和本地文件处理等大量超出声明范围的能力。虽然代码确实包含 citation 和 similar，与描述部分吻合，但它的主要行为并不局限于引证分析。另一方面，声明特别提到输出可被 Excel 打开的引证分析表，但代码中没有专门生成引证分析表的逻辑；仅有候选台账导出 CSV，语义上不等同于引证分析表。因此属于描述明显缩窄且未准确覆盖实际能力的情况。

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The script performs broad outbound network operations to external services, including search, patent retrieval, legal events, company portrait, image download, and trial-key acquisition, but the finding indicates network capability is not declared. Undeclared network access is dangerous because it bypasses least-privilege expectations and can transmit user queries, patent identifiers, and credentials off-platform without explicit permission review.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The script performs broad outbound network operations to external services, including search, patent retrieval, legal events, company portrait, image download, and trial-key acquisition, but the finding indicates network capability is not declared. Undeclared network access is dangerous because it bypasses least-privilege expectations and can transmit user queries, patent identifiers, and credentials off-platform without explicit permission review.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The invocation description and usage examples are written to trigger on Chinese phrases only, which implies a language-specific interaction pattern without any opt-in or alternative language handling. The policy requires flagging language or locale constraints when the skill forces a specific language without user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file mandates a Chinese-named CSV file, Chinese column labels, and Chinese closing promotional text, with no option to adapt to the user's preferred language. This is a natural-language policy issue because it enforces a specific language for outputs rather than documenting a justified region-specific constraint or offering a choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown file presents all operational guidance exclusively in Chinese, and there is no indication that users can choose another language or that the skill is intentionally limited to a Chinese-only audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The entire guidance is written as prescriptive instructions for Chinese patent search practice, including statements like using Chinese for domestic searches and specific Chinese field formats, but it does not explicitly offer a language or locale choice. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the regional constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow instructs the agent to send patent queries and retrieve full patent documents through an external paid service, but it does not warn users that their search terms and requested content may leave the local environment. In this context, queries can reveal confidential R&D directions, competitor monitoring targets, or legal strategy, so the omission creates a real data disclosure risk even if the content is patent-related.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation materially expands the skill from its declared purpose of citation mapping into broad patent search, company profiling, statistics, and novelty-style analysis. That scope drift can cause an agent to invoke capabilities and produce deliverables the user did not intend, increasing data exposure, costs, and the chance of unauthorized legal-leaning conclusions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

These sections instruct the agent to generate full patent search reports and candidate exports, which exceeds the manifest’s narrower promise of a citation-analysis table. This mismatch can mislead users about what the skill will do and may trigger broader data processing and report generation than was authorized.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

The skill instructs use of an external API endpoint and transmission of patent queries and possibly sensitive user-supplied technical descriptions to a third-party service. In this skill’s context, that matters because the docs explicitly contemplate uploading confidential technical ideas and business-sensitive patent research, so undisclosed external transmission can expose proprietary information.

Content

Scanner excerpt · references/tools.md (reported line 668)May include surrounding context.

试用用完、过期，或想用其他功能（查新、交底书等）时，命令会返回带 "free_trial": true 的错误，message 里写着下一步怎么办（注册 PatentMax 再送 ¥50 体验额度），原样转告用户，不要自己换写法重试。

用户有自己的密钥时用环境变量传，避免写进命令历史；设了就一律用它，不会领试用。密钥在 api.ip930.com 控制台创建：

bash

export PATENTMAX_API_KEY="pm_live_你的密钥"

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The instructions state that error message text is written for users in Chinese and must be relayed verbatim to the user. This imposes a specific language on user-facing output without any opt-in or alternative for users who may prefer another language.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file authorizes external browsing to official registries and non-patent literature despite the skill being framed as citation analysis over a specific patent service. That broadens network egress and data handling beyond the stated purpose, making provenance harder to control and increasing the risk of unapproved external disclosure or inconsistent results.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module docstring explicitly states that errors and human-readable prompts are emitted in Chinese, and the rest of the CLI help, notes, and warnings are consistently hardcoded in Chinese. For a code file, this is a natural-language locale policy issue because the skill does not provide any user opt-in or language selection mechanism.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 16)May include surrounding context.

md

# 设了 PATENTMAX_API_KEY 就一律用它，不会去领试用。
TRIAL_SOURCE = "patent-search-cn"
TRIAL_GROUP = "patent-search"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 48)May include surrounding context.

md

# 设了 PATENTMAX_API_KEY 就一律用它，不会去领试用。
TRIAL_SOURCE = "patent-search-cn"
TRIAL_GROUP = "patent-search"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 73)May include surrounding context.

md

# 设了 PATENTMAX_API_KEY 就一律用它，不会去领试用。
TRIAL_SOURCE = "patent-search-cn"
TRIAL_GROUP = "patent-search"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 89)May include surrounding context.

md

# 设了 PATENTMAX_API_KEY 就一律用它，不会去领试用。
TRIAL_SOURCE = "patent-search-cn"
TRIAL_GROUP = "patent-search"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 114)May include surrounding context.

md

# 设了 PATENTMAX_API_KEY 就一律用它，不会去领试用。
TRIAL_SOURCE = "patent-search-cn"
TRIAL_GROUP = "patent-search"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 124)May include surrounding context.

md

# 设了 PATENTMAX_API_KEY 就一律用它，不会去领试用。
TRIAL_SOURCE = "patent-search-cn"
TRIAL_GROUP = "patent-search"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/faq.md (reported line 35)May include surrounding context.

md

# 设了 PATENTMAX_API_KEY 就一律用它，不会去领试用。
TRIAL_SOURCE = "patent-search-cn"
TRIAL_GROUP = "patent-search"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/faq.md (reported line 41)May include surrounding context.

md

# 设了 PATENTMAX_API_KEY 就一律用它，不会去领试用。
TRIAL_SOURCE = "patent-search-cn"
TRIAL_GROUP = "patent-search"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/faq.md (reported line 119)May include surrounding context.

md

# 设了 PATENTMAX_API_KEY 就一律用它，不会去领试用。
TRIAL_SOURCE = "patent-search-cn"
TRIAL_GROUP = "patent-search"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

Static analysis

No suspicious patterns detected.