Security audit

专利法律状态

Security checks for vulnerabilities and agentic risk

Overview

The patent-checking workflow is coherent, but credential protection and cache-file handling flaws warrant review before installation.

Prefer a version that validates patent identifiers, confines cache paths, and blocks unsafe authenticated redirects. Avoid providing paid keys in chat; use protected credential configuration. Patent numbers and query terms go to PatentMax, and calls can consume account credit.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (39)

Tainted flow: 'req' from os.environ.get (line 138, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/patentmax_client.py (reported line 142)May include surrounding context.
python
req.add_header("Content-Type", "application/json") req.add_header("Accept", "application/json") try: with urllib.request.urlopen(req, timeout=30) as response: payload = json.loads(response.read().decode("utf-8")) except urllib.error.HTTPError as exc: message = _server_message(exc.read().decode("utf-8", "replace"))

Tainted flow: 'req' from os.environ.get (line 333, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 94% confidence
Finding: Sending the API key to the intended PatentMax service is necessary for this skill, not evidence of malicious exfiltration. However, the request uses urllib's default redirect handling, which can forward the explicitly added Authorization header to a different origin, and the configurable base URL is not restricted to HTTPS; an attacker-controlled redirect or insecure endpoint can therefore expose the bearer credential.
Content: Scanner excerpt · scripts/patentmax_client.py (reported line 344)May include surrounding context.
python
req.add_header(key, value) try: with urllib.request.urlopen(req, timeout=TIMEOUT) as response: payload = response.read() # 服务端每个响应都回本次实扣和扣完后的余额。记下来，供 _spent/_balance 输出。 # 拿服务端的真值，而不是在本地累加估价：跨进程累加迟早算岔，

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The supplied command exposes a credential prefix rather than querying patent legal status or generating a checklist. Although using an API key for authentication could support the declared purpose, printing part of that key is an undeclared disclosure and is not necessary for the stated functionality. No external transmission is shown.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The code partially supports the declared purpose through normalized legal-status fields, the optional /api/legal request, and CSV export. However, its exposed commands implement a substantially broader patent research and analytics toolkit. The CSV export is a research-candidate ledger, not the promised legal-status verification table: it lacks dedicated lapse-reason and estimated-expiry fields. API authentication, trial-key caching, billing tracking, and budget controls are supporting implementation details rather than the basis for this mismatch.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The supplied commands perform patent discovery and similarity searching rather than legal-status verification. They do not visibly query validity, lapse reasons, or expiry information, or generate the declared status checklist. These search capabilities represent a materially different purpose, not merely supporting implementation details for the described batch status check.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The commands operate on candidate-selection records: 'keep' and 'exclude' indicate selection decisions, not legal states such as in force, lapsed, or pending. Although CSV export aligns with the declared output format, the supplied chunk does not show legal-status checks, lapse reasons, or expiry estimates. Its candidate-management operations are materially different from the declared purpose. The underlying client implementation was not supplied, so this assessment is limited to the visible commands.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The supplied chunk queries the general search endpoint using technology keywords. It does not accept a list of patent numbers, request legal-status information, assess validity or expiry, or generate a checklist. Authentication and the API call are not inherently mismatches; the material mismatch is the search task actually performed. This assessment is limited to the supplied chunk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The visible commands perform patent-content and related-patent research rather than the declared legal-status checking workflow. They do not visibly request legal status, determine validity or expiry, process a batch of supplied patent numbers, or generate a checklist table. Although these operations concern patents, citation and similarity searches are distinct capabilities with no demonstrated supporting role in the declared status check. The client implementation is not supplied, so this assessment is limited to the commands shown.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The supplied command searches for patents similar to a fixed patent number. It does not request legal status, lapse reasons, expiry estimates, or checklist output. Similarity searching is a materially different capability and is not shown to support the declared status-checking workflow.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Although one search example filters for valid patents and could support legal-status checking, the chunk primarily demonstrates broader patent research and content-retrieval capabilities not declared in the description. It does not demonstrate batch status verification, lapse explanations, expiry estimation, or an Excel-compatible checklist. The mismatch is based on the supplied commands; the client's internal implementation is not available for assessment.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The command invokes the client's search operation with technology keywords, not patent identifiers or legal-status criteria. The supplied chunk shows no status verification or checklist generation, and its fixed topical search is not evidently a supporting step for the declared task. This assessment is limited to the shown command; the client's internal behavior is not provided.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The supplied command performs a subject-matter patent search. It does not supply patent numbers or request legal status, lapse reasons, or expiry estimates. This is a materially different operation from the declared status-checking purpose. The JSON output format alone is not the basis for the mismatch.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The supplied command searches for patents about a specific technology. It does not accept a list of patent numbers, explicitly request legal-status information, determine validity or expiry, or generate a checklist table. Patent searching could support a broader status-checking workflow, but this hardcoded topical query has no demonstrated connection to the declared task.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The supplied command targets /api/claims, which concerns patent claims rather than legal status. It contains no legal-status query or processing that connects this retrieval to the declared validity check. Batch handling, expiry estimation, and checklist generation are also not demonstrated in this chunk. The API authentication itself is a supporting implementation detail, not a separate mismatch.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The supplied command searches for patents belonging to a specific applicant. It does not identify user-supplied patent numbers, request legal-status checks, or generate the declared checklist. Although patent searching could support a broader verification workflow, the fixed applicant search shown here has no demonstrated connection to that purpose. The client's internal behavior is not provided, so no additional capabilities are inferred.
Content: No source excerpt is available for this finding.

Code capability 'env' detected in scripts/patentmax_client.py but not covered by declared permissions.

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'env' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.
Content: No source excerpt is available for this finding.

Code capability 'network' detected in scripts/patentmax_client.py but not covered by declared permissions.

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'network' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.
Content: No source excerpt is available for this finding.

The workflow sends user-supplied patent numbers to PatentMax without disclosing that external transmission.

Medium

Category: Output Handling
Confidence: 90% confidence
Finding: The workflow instructs the agent to extract patent numbers from user input or files and submit them in external searches. Although the skill identifies PatentMax as its data source and discloses search costs, it does not warn that the user's patent list will be transmitted to that third party; the selection of patents from a contract or application can itself reveal confidential business interests.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api-reference.md (reported line 16)May include surrounding context.
bash
curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY" \ "https://api.ip930.com/api/patent?pn=CN109761224A"

服务端自己完成内部寻址，这些前置调用不进用户账单。

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api-reference.md (reported line 89)May include surrounding context.
bash
curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY" \ "https://api.ip930.com/api/patent?pn=CN109761224A"

某一块上游取不到时，该字段为 null 并在 unavailable 里列出，其余照常返回；

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api-reference.md (reported line 114)May include surrounding context.
bash
curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY" \ "https://api.ip930.com/api/claims?pn=CN109761224A"

只要同时需要两块以上，就用 /api/patent——它一口价，拆开单买反而贵。

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api-reference.md (reported line 48)May include surrounding context.
服务端直接返回上次的结果、不再扣费；同一个键换了参数会被拒（400）；上一次还在处理中返回 409。

bash
curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY" -H "Idempotency-Key: task42-search-1" "https://api.ip930.com/api/search?q=%E6%B5%B8%E6%B2%A1%E5%BC%8F%E6%B6%B2%E5%86%B7&ds=cn&size=20"

网络超时、不确定上一次有没有成功时，用同一个键重发，不要换键。

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api-reference.md (reported line 73)May include surrounding context.
curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY"
--data-urlencode 'q=(固态电池 OR 全固态电池) AND 电解质'
--data-urlencode 'ds=all' --data-urlencode 'size=20'
-G "https://api.ip930.com/api/search"

text
> 检索式里有中文和括号，一定用 `--data-urlencode -G`，别手工拼 URL。

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/tools.md (reported line 668)May include surrounding context.
试用用完、过期，或想用其他功能（查新、交底书等）时，命令会返回带 "free_trial": true 的错误，message 里写着下一步怎么办（注册 PatentMax 再送 ¥50 体验额度），原样转告用户，不要自己换写法重试。

用户有自己的密钥时用环境变量传，避免写进命令历史；设了就一律用它，不会领试用。密钥在 api.ip930.com 控制台创建：

bash
export PATENTMAX_API_KEY="pm_live_你的密钥"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/faq.md (reported line 35)May include surrounding context.
md
- **密钥复制不全。** 前后有没有多余空格、有没有漏掉尾部字符 - **少了 `Bearer ` 前缀。** 用 curl 时 header 必须是 `Authorization: Bearer pm_live_xxx`，只写密钥不行 - **密钥被撤销了。** 到 [控制台](https://api.ip930.com/features/api-platform)看状态 > 还有个容易踩的：如果请求里带了 `Authorization` 头，URL 上的 `?apikey=` 就不会被读取。两种方式选一种，别混用——带了一个格式错误的 header，正确的 URL 参数也会被忽略。