ClawHub
Back to skill

Security audit

Patent Competitor Analysis · PatentMax

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed PatentMax cloud client that generates paid patent-competition reports, with some privacy and local-cache considerations but no evidence of malicious behavior.

Install only if you are comfortable sending patent-analysis inputs, company names, objectives, markets, and any optional background files to api.ip930.com. Do not upload confidential diligence materials without approval, verify cost before allowing --yes, and expect a local ~/.patentmax cache for the trial key and task state.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (21)

Tainted flow: 'req' from os.environ.get (line 210, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/patentmax_competitive.py (reported line 134)May include surrounding context.

python
req.add_header("Content-Type", "application/json")
    req.add_header("Accept", "application/json")
    try:
        with urllib.request.urlopen(req, timeout=30) as response:
            payload = json.loads(response.read().decode("utf-8"))
    except urllib.error.HTTPError as exc:
        _, message = _server_error(exc.read().decode("utf-8", "replace"))

Tainted flow: 'req' from os.environ.get (line 210, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/patentmax_competitive.py (reported line 217)May include surrounding context.

python
req.add_header("Content-Type", "application/json")
    for key, value in (headers or {}).items():
        req.add_header(key, value)
    return urllib.request.urlopen(req, timeout=TIMEOUT)


def request(path, method="GET", body=None, headers=None, raw=False):

Lp1

High
Category
MCP Least Privilege
Confidence
94% confidence
Finding

Undeclared network capability is a real security issue in agent skills because it bypasses informed consent and policy gating for data egress. In this skill, company names, materials, objectives, and possibly uploaded document contents are sent to an external API, so permission transparency matters materially.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
94% confidence
Finding

Undeclared network capability is a real security issue in agent skills because it bypasses informed consent and policy gating for data egress. In this skill, company names, materials, objectives, and possibly uploaded document contents are sent to an external API, so permission transparency matters materially.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill title and the entire usage/documentation are presented only in Chinese, and the file does not offer an alternative language, opt-in, or explain that the skill is intentionally limited to Chinese-speaking users or a China-specific compliance context. Under the policy rule, forcing a specific language without user choice is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation at L042 says the report covers '我方位置 — 空档在哪、哪些方向已经拥挤、绕不开的核心专利是哪几件', which goes beyond neutral competitor analysis and moves toward prescriptive strategic positioning. This conflicts with L101, which explicitly says '不给布局建议' and that the skill only describes the current state rather than what the user should do next.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The skill explicitly directs users to transmit data to an external PatentMax service and says the first run automatically claims a trial stored locally. In this skill context, user inputs include company names, technology focus, markets, time ranges, and potentially background materials; sending that intelligence externally can leak sensitive business research intentions or confidential diligence topics if users are not clearly warned and consent is not explicit.

Content

Scanner excerpt · README.md (reported line 55)May include surrounding context.

不需要密钥，装上就能用。 第一次运行时脚本自动领取一份免费试用：累计 ¥40 额度、30 天有效，存在本机 ~/.patentmax/。

试用用完后，在 api.ip930.com 注册（再送 ¥50 体验额度）并创建密钥，设成环境变量即可，设了就不再用试用：

bash
export PATENTMAX_API_KEY="pm_live_你的密钥"

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
author: PatentMax
user-invocable: true
argument-hint: "[企业名称 / 技术方向 / 分析目标]"
allowed-tools: Bash, Read, Write
---

# 企业专利分析 · PatentMax

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
author: PatentMax
user-invocable: true
argument-hint: "[企业名称 / 技术方向 / 分析目标]"
allowed-tools: Bash, Read, Write
---

# 企业专利分析 · PatentMax

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instructions require that user-facing error messages be relayed verbatim in Chinese, and also require relaying a fixed Chinese trial message verbatim. This imposes a specific language on users without documenting a locale constraint or offering an opt-in/choice, which matches the language-policy violation criteria.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/faq.md (reported line 25)May include surrounding context.

md
Windows PowerShell 用 `$env:PATENTMAX_API_KEY="..."`，CMD 用 `set PATENTMAX_API_KEY=...`。`export` 只对当前终端有效，换窗口要重设。

密钥在 https://api.ip930.com/features/api-platform 自助创建。

## 400 参数不正确

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/faq.md (reported line 129)May include surrounding context.

md
Windows PowerShell 用 `$env:PATENTMAX_API_KEY="..."`，CMD 用 `set PATENTMAX_API_KEY=...`。`export` 只对当前终端有效，换窗口要重设。

密钥在 https://api.ip930.com/features/api-platform 自助创建。

## 400 参数不正确

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/faq.md (reported line 129)May include surrounding context.

实在没有就直接发 HTTP 请求：

bash
curl -s -X POST "https://api.ip930.com/api/v1/reports" \
  -H "Authorization: Bearer $PATENTMAX_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 自定义唯一串" \

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This markdown file contains all operational instructions in Chinese and does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The workflow contains materially conflicting guidance: it says this task should only describe the current state and not make recommendations, but elsewhere tells the agent to deliver a decision-support conclusion and bypass/risk suggestions. In a paid competitive-intelligence workflow, this inconsistency can cause the agent to overstep scope, produce unsupported strategic advice, and mislead users into treating speculative output as validated recommendations.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/patentmax_competitive.py (reported line 8)May include surrounding context.

python
**每条命令最多跑 30 秒就返回。** WorkBuddy 这类宿主前台跑命令时，要等命令结束才显示输出，
AI 中途也插不了话；一条命令阻塞几十分钟，用户就几十分钟什么都看不到，宿主还可能把命令掐掉。
所以 create 提交后只等 15 秒就先返回，之后用 wait 接着等，每次最多 30 秒：

    退出码 0   完成了（Word 报告已自动下载到提交时的目录）
    退出码 10  还在生成：把输出里的「[进度]」行告诉用户，再运行一次 wait

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/patentmax_competitive.py (reported line 8)May include surrounding context.

python
**每条命令最多跑 30 秒就返回。** WorkBuddy 这类宿主前台跑命令时,要等命令结束才显示输出,
AI 中途也插不了话;一条命令阻塞几十分钟,用户就几十分钟什么都看不到,宿主还可能把命令掐掉。
所以 create 提交后只等 15 秒就先返回,之后用 wait 接着等,每次最多 30 秒:

    退出码 0   完成了(Word 报告已自动下载到提交时的目录)
    退出码 10  还在生成:把输出里的「[进度]」行告诉用户,再运行一次 wait

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The code explicitly instructs that error messages shown to users must be Chinese and relayed verbatim, which imposes a specific language on user-facing output. This is a natural-language policy concern because the skill does not offer any locale selection or opt-in despite extensive user-visible strings and instructions being fixed in Chinese.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The skill automatically contacts an external service to register/obtain a free trial key, which is a real external transmission behavior. In context, this is more sensitive because it can happen automatically when no API key is configured, meaning operators may not realize the tool is establishing a third-party relationship and transmitting usage metadata.

Content

Scanner excerpt · scripts/patentmax_competitive.py (reported line 92)May include surrounding context.

python
# 密钥版（TRIAL_SOURCE 为空）：必须设 PATENTMAX_API_KEY，不领试用。
TRIAL_SOURCE = "patent-competitor-analysis"
TRIAL_GROUP = "competitive"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The skill is designed to send user inputs and report-generation materials to api.ip930.com, which is an actual external data transfer. Because this skill processes competitive intelligence and patent due-diligence materials, the context increases sensitivity: uploaded materials may include confidential business information, making undeclared or insufficiently disclosed egress more dangerous.

Content

Scanner excerpt · scripts/patentmax_competitive.py (reported line 171)May include surrounding context.

python
if API_KEY:
        return API_KEY
    if not TRIAL_SOURCE:
        die("还没有设置 PatentMax 密钥。到 https://api.ip930.com/features/api-platform 注册（新用户送 ¥50 体验额度）"
            "并创建密钥，设成环境变量 PATENTMAX_API_KEY=pm_live_xxx 后，再运行同一条命令。", EXIT_INPUT)
    API_KEY = _load_trial_key() or _claim_trial_key()
    KEY_FROM_TRIAL = True

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The entire guide is written as prescriptive Chinese-language instructions and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-only or China-specific workflow. Under the stated policy, forcing a specific language or locale without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.