Patent Drafting · PatentMax

• Outcome: Review
• Latest audit: Oct 15, 2026 · 4:03 AM UTC
• Version: 1.1.3

Overview

The skill is a coherent PatentMax patent-drafting client, but it needs Review because it uploads likely confidential invention materials to a remote service with limited pre-upload privacy guidance and an unrestricted API endpoint override.

Install only if you are comfortable sending invention disclosures and related R&D materials to PatentMax/api.ip930.com. Use it with organizational approval for confidential or pre-filing IP, minimize/redact unnecessary sensitive details, avoid setting PATENTMAX_BASE_URL unless you fully trust the endpoint, and protect PATENTMAX_API_KEY and the ~/.patentmax cache.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (29)

Tainted flow: 'req' from os.environ.get (line 221, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The request target is derived from environment-controlled configuration (BASE_URL), and the code automatically obtains and then uses API credentials against that endpoint. If an attacker can influence environment variables, they can redirect requests to a malicious server and capture the PATENTMAX_API_KEY or trial key, as well as uploaded patent materials. In this skill, the transmitted content is highly sensitive IP/disclosure data, which raises the severity.

Content

Scanner excerpt · scripts/patentmax_disclosure.py (reported line 145)May include surrounding context.

python

req.add_header("Content-Type", "application/json")
    req.add_header("Accept", "application/json")
    try:
        with urllib.request.urlopen(req, timeout=30) as response:
            payload = json.loads(response.read().decode("utf-8"))
    except urllib.error.HTTPError as exc:
        _, message = _server_error(exc.read().decode("utf-8", "replace"))

Tainted flow: 'req' from os.environ.get (line 221, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 97% confidence

Finding

The generic request() path sends Authorization: Bearer credentials and user-provided patent materials to a URL built from BASE_URL, which is read from the environment. An attacker who can set PATENTMAX_BASE_URL can exfiltrate both secrets and confidential uploaded documents to an attacker-controlled service. Because this tool is specifically for patent drafting, exposure of pre-filing invention disclosures can cause severe confidentiality and business harm.

Content

Scanner excerpt · scripts/patentmax_disclosure.py (reported line 230)May include surrounding context.

python

req.add_header(key, value)

    try:
        with urllib.request.urlopen(req, timeout=TIMEOUT) as response:
            payload = response.read()
            return payload if raw else json.loads(payload.decode("utf-8"))
    except urllib.error.HTTPError as exc:

Lp1

High

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

This skill makes outbound HTTPS requests and uploads local document contents, yet the static finding says network capability is not declared. In a hosted agent environment, undeclared network access is a real security issue because it can enable silent exfiltration of sensitive user files without matching platform policy or user consent flows.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

This skill makes outbound HTTPS requests and uploads local document contents, yet the static finding says network capability is not declared. In a hosted agent environment, undeclared network access is a real security issue because it can enable silent exfiltration of sensitive user files without matching platform policy or user consent flows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill handles highly sensitive invention disclosures and says each invention point is compared against a global patent database, implying external transmission of proprietary material. Without an explicit privacy/data-sharing warning, users may unknowingly send confidential pre-filing IP to a third party, creating serious confidentiality, leakage, and contractual/compliance risks.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The manifest states that all models used are domestic and that no foreign models are used, which is a concrete behavioral claim about the system. The README shows the skill obtaining trial credentials and then calling the PatentMax API platform, but provides no code- or docs-level basis in this file to support the stronger '0 foreign models' claim; instead, the actual behavior is outsourcing generation/comparison to an external service.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 96% confidence

Finding

The README explicitly directs users to configure and use an external API for patent drafting. In this skill context, the transmitted content is likely confidential invention material, so sending it to a remote service materially increases the risk of IP leakage, unauthorized retention, jurisdictional transfer issues, and exposure through provider compromise or misuse.

Content

Scanner excerpt · README.md (reported line 65)May include surrounding context.

不需要密钥，装上就能用。 第一次运行时脚本自动领取一份免费试用：累计 ¥40 额度、30 天有效，存在本机 ~/.patentmax/。

试用用完后，在 api.ip930.com 注册（再送 ¥50 体验额度）并创建密钥，设成环境变量即可，设了就不再用试用：

bash

export PATENTMAX_API_KEY="pm_live_你的密钥"

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README instructs users to interact with the AI using a Chinese phrase and all user-facing documentation is written as if Chinese is required. There is no indication that other languages are supported, optional, or intentionally restricted for a documented compliance reason.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill metadata hard-codes a model-origin restriction ('All models are made in China; no foreign models are used') rather than letting the user choose or clearly framing it as informational. This can create policy/compliance and trust risks because routing decisions may be influenced by vendor nationality instead of user consent, organizational policy, or security requirements.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The body of the skill repeats the mandatory model-origin constraint, reinforcing that only a specific national-origin model stack will be used with no user choice. Repetition makes the restriction operationally stronger and may steer sensitive patent materials to a provider ecosystem the user did not knowingly select, increasing privacy, legal, and procurement risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/faq.md (reported line 7)May include surrounding context.

md

| 现象 | 处理 |
| --- | --- |
| `免费试用额度已用完` / `免费试用只开通了……` | 免费试用的额度用完了，或者想用别的功能。注册 PatentMax 再送 ¥50 体验额度，创建密钥后 `export PATENTMAX_API_KEY=pm_live_xxx`：https://api.ip930.com/features/api-platform |
| `免费试用密钥已过期或失效` | 本地缓存已自动清掉，重跑同一条命令会领新的；或者换成正式密钥 |
| `HTTP 401` | 密钥无效或已撤销，到控制台重新创建 |
| `HTTP 402` | 余额不足，到控制台充值 |

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/faq.md (reported line 75)May include surrounding context.

md

| 现象 | 处理 |
| --- | --- |
| `免费试用额度已用完` / `免费试用只开通了……` | 免费试用的额度用完了，或者想用别的功能。注册 PatentMax 再送 ¥50 体验额度，创建密钥后 `export PATENTMAX_API_KEY=pm_live_xxx`：https://api.ip930.com/features/api-platform |
| `免费试用密钥已过期或失效` | 本地缓存已自动清掉，重跑同一条命令会领新的；或者换成正式密钥 |
| `HTTP 401` | 密钥无效或已撤销，到控制台重新创建 |
| `HTTP 402` | 余额不足，到控制台充值 |

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/faq.md (reported line 79)May include surrounding context.

md

| 现象 | 处理 |
| --- | --- |
| `免费试用额度已用完` / `免费试用只开通了……` | 免费试用的额度用完了，或者想用别的功能。注册 PatentMax 再送 ¥50 体验额度，创建密钥后 `export PATENTMAX_API_KEY=pm_live_xxx`：https://api.ip930.com/features/api-platform |
| `免费试用密钥已过期或失效` | 本地缓存已自动清掉，重跑同一条命令会领新的；或者换成正式密钥 |
| `HTTP 401` | 密钥无效或已撤销，到控制台重新创建 |
| `HTTP 402` | 余额不足，到控制台充值 |

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/faq.md (reported line 83)May include surrounding context.

md

| 现象 | 处理 |
| --- | --- |
| `免费试用额度已用完` / `免费试用只开通了……` | 免费试用的额度用完了，或者想用别的功能。注册 PatentMax 再送 ¥50 体验额度，创建密钥后 `export PATENTMAX_API_KEY=pm_live_xxx`：https://api.ip930.com/features/api-platform |
| `免费试用密钥已过期或失效` | 本地缓存已自动清掉，重跑同一条命令会领新的；或者换成正式密钥 |
| `HTTP 401` | 密钥无效或已撤销，到控制台重新创建 |
| `HTTP 402` | 余额不足，到控制台充值 |

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/faq.md (reported line 85)May include surrounding context.

md

| 现象 | 处理 |
| --- | --- |
| `免费试用额度已用完` / `免费试用只开通了……` | 免费试用的额度用完了，或者想用别的功能。注册 PatentMax 再送 ¥50 体验额度，创建密钥后 `export PATENTMAX_API_KEY=pm_live_xxx`：https://api.ip930.com/features/api-platform |
| `免费试用密钥已过期或失效` | 本地缓存已自动清掉，重跑同一条命令会领新的；或者换成正式密钥 |
| `HTTP 401` | 密钥无效或已撤销，到控制台重新创建 |
| `HTTP 402` | 余额不足，到控制台充值 |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The FAQ provides ready-to-run API examples that send patent disclosure text and related materials to an external service using an authorization token, but it does not warn users about confidentiality, sensitive IP handling, retention, or organizational approval requirements. For a patent-drafting skill, the uploaded material is often highly sensitive pre-filing intellectual property, so omission of privacy and data-handling guidance materially increases the risk of accidental disclosure.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This finding overlaps with the POST example and correctly identifies external transmission to api.ip930.com. The danger is elevated by the skill context: patent disclosures are commercially sensitive, and sending them off-platform without privacy guidance can expose trade secrets or affect internal handling requirements.

Content

Scanner excerpt · references/faq.md (reported line 60)May include surrounding context.

bash

# 提交初稿
curl -s -X POST "https://api.ip930.com/api/v1/reports" \
  -H "Authorization: Bearer $PATENTMAX_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 任取一个唯一串" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This finding overlaps with the POST example and correctly identifies external transmission to api.ip930.com. The danger is elevated by the skill context: patent disclosures are commercially sensitive, and sending them off-platform without privacy guidance can expose trade secrets or affect internal handling requirements.

Content

Scanner excerpt · references/faq.md (reported line 60)May include surrounding context.

bash

# 提交初稿
curl -s -X POST "https://api.ip930.com/api/v1/reports" \
  -H "Authorization: Bearer $PATENTMAX_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 任取一个唯一串" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This example submits idea text to an external service to generate patent directions. Even when only an 'idea' is sent, that idea may represent unfiled intellectual property, so the lack of caution around external disclosure creates a real confidentiality risk.

Content

Scanner excerpt · references/faq.md (reported line 67)May include surrounding context.

md

-d '{"report_type":"technical_disclosure","input":{"supplement":"材料正文……","title_hint":"案件名称"}}'

# 出方向
curl -s -X POST "https://api.ip930.com/api/v1/reports" \
  -H "Authorization: Bearer $PATENTMAX_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 任取一个唯一串" \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide tells users materials will be sent to a server and says not to submit full code, but it does not clearly and prominently warn against uploading other sensitive content such as trade secrets, credentials, internal architecture details, customer data, or unpublished source materials. In a patent-drafting workflow, users are especially likely to submit highly confidential R&D documents, so incomplete data-minimization guidance increases the risk of inadvertent sensitive-data exfiltration to the service backend.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The workflow instructs the agent to upload user-provided R&D and patent disclosure materials to an external paid service, but it does not require an explicit warning that the files leave the local environment or may contain confidential, trade-secret, or personal data. In a patent-drafting context this is especially sensitive because pre-filing invention disclosures can be highly confidential, so users need informed consent before transmission.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/patentmax_disclosure.py (reported line 11)May include surrounding context.

python

**每条命令最多跑 30 秒就返回。** WorkBuddy 这类宿主前台跑命令时，要等命令结束才显示输出，
AI 中途也插不了话；一条命令阻塞十几分钟，用户就十几分钟什么都看不到，宿主还可能把命令掐掉。
所以 create / ideas 提交后只等 15 秒就先返回，之后用 wait 接着等，每次最多 30 秒：

    退出码 0   这一步有结果了（wait 完成时已自动下载好 Word）
    退出码 10  还在生成：把输出里的「[进度]」行告诉用户，再运行一次 wait

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/patentmax_disclosure.py (reported line 11)May include surrounding context.

python

**每条命令最多跑 30 秒就返回。** WorkBuddy 这类宿主前台跑命令时,要等命令结束才显示输出,
AI 中途也插不了话;一条命令阻塞十几分钟,用户就十几分钟什么都看不到,宿主还可能把命令掐掉。
所以 create / ideas 提交后只等 15 秒就先返回,之后用 wait 接着等,每次最多 30 秒:

    退出码 0   这一步有结果了(wait 完成时已自动下载好 Word)
    退出码 10  还在生成:把输出里的「[进度]」行告诉用户,再运行一次 wait

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The docstring instructs that error messages are '给用户看的中文说明' and should be relayed verbatim, which imposes a specific language on user interactions. Elsewhere the script consistently frames progress and user-visible messages as Chinese-only, with no opt-in, fallback, or documented region-specific justification.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The script is designed to transmit data to an external third-party service and even auto-enroll for a trial key if no API key is configured. This is a true data-exposure concern in context because users may provide unpublished invention disclosures, R&D reports, and technical schemes; sending them off-platform to a remote API can leak highly confidential intellectual property if not explicitly disclosed and consented to.

Content

Scanner excerpt · scripts/patentmax_disclosure.py (reported line 103)May include surrounding context.

python

# 密钥版（TRIAL_SOURCE 为空）：必须设 PATENTMAX_API_KEY，不领试用。
TRIAL_SOURCE = "patent-drafting"
TRIAL_GROUP = "disclosure"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

Static analysis

No suspicious patterns detected.