专利号识别

• Outcome: Review
• Latest audit: Oct 30, 2026 · 12:34 PM UTC
• Version: 1.0.0

Overview

The offline extractor is appropriately scoped, but the optional online client has unsafe spreadsheet exports and incomplete credential-storage safeguards.

Use the offline extraction workflow for supplied documents. Before online use, explicitly approve the transmitted identifiers and spending limit, prefer a process-only API key, and import candidate CSV files as plain text until formula handling is fixed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/patentmax_client.py

Finding

External patent metadata is exported as executable spreadsheet formulas

Content

View full analysis

Impact

A formula placed in a metadata field can execute spreadsheet functions when the CSV is opened. Depending on the spreadsheet application and its security settings, this can initiate attacker-directed network requests or display deceptive links and calculated content. CSV quoting does not neutralize formulas.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (51)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 100% confidence

Finding

The supplied code has a materially different primary purpose: it queries a commercial patent-data service rather than identifying patent-number candidates in user-provided documents. Its number-related helpers validate and normalize explicitly provided identifiers or compare returned identifiers; they do not implement the promised extraction workflow. Network access, credential handling, automatic trial provisioning, and potentially charged retrieval and analysis are substantive undeclared capabilities, not supporting details of text extraction. The local read command only examines this client's saved result files and does not supply the missing source-text extraction behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 100% confidence

Finding

The supplied shell command performs no patent-number extraction. Instead, it accesses and partially exposes a credential, which is unrelated to the declared purpose and is not a supporting implementation detail.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied commands implement patent discovery and similarity searching, not textual patent-number extraction. They do not provide the declared original-text locations, context, or number-category separation. Using a patent number as an input to a similarity search does not make that operation part of extracting numbers or tracing their locations in the supplied text.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The shown command searches an external database; it does not extract patent numbers from input text or produce source locations, context, or candidate classifications. External authenticated search is a materially different capability, not a supporting implementation detail of the declared extraction task. The chunk does not show patent-number authenticity verification or transmission of user-supplied text.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The command performs a remote patent search, which is a materially different capability from identifying patent-number candidates in user-provided text. It contains no extraction, source-location tracking, contextual reporting, or number-category separation. The external lookup is not merely a supporting implementation detail for the declared text-extraction behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The command runs the client's search operation, not a text-extraction operation. Patent searching is not declared and is not a necessary implementation detail of recognizing numbers and reporting their original text locations. The snippet does not establish the client's underlying network behavior, but the visible search operation is sufficient to identify a mismatch.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is text-local patent-number extraction and source-location reporting. The supplied commands instead expose patent research and document-retrieval operations, including a paid lookup and image-file output. These are substantial additional capabilities, not implementation details needed to extract numbers from supplied text. The client implementation is not included, so its precise network behavior cannot be verified, but the command interface and accompanying comments clearly show the scope mismatch.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The command performs a patent-search operation, not the declared text-extraction workflow. Searching for patents by applicant is a materially different, undeclared capability rather than a supporting implementation detail. The supplied chunk does not show the client's internals, so network access or authentication behavior cannot be confirmed.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The command does not identify patent numbers or report their source locations and context. Instead, it queries an external claims API for a fixed patent number. This is a distinct retrieval capability, not a supporting implementation detail of the declared text-extraction task. Although the description mentions tracing source material, it does not describe authenticated claims retrieval for an arbitrary hard-coded patent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied command performs a remote patent lookup rather than extracting candidates or source locations from user-provided text. External retrieval and credential use are not necessary supporting details for the declared text-extraction task and are not disclosed. The command alone does not establish authenticity verification or malicious credential exfiltration.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The command performs a similarity-search operation, which is not declared and is materially different from extracting patent-number candidates and their source locations. The supplied chunk contains no text extraction or provenance-reporting behavior. The client's implementation is not shown, so network access cannot be confirmed from this chunk alone.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The command implements a patent-search workflow, which is not declared by the text-extraction description. It does not supply source text for extraction or request original spelling, line and column locations, context, or candidate classification. The client's internal implementation is not shown, so network access cannot be confirmed from this chunk alone.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied command queries an external patent service for a hard-coded patent number. It does not process supplied text or produce candidate locations, context, or number-type separation. External patent lookup is a distinct, undeclared capability rather than an implementation detail needed for the described local text-extraction task. The command alone does not establish that authenticity verification occurs.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The commands perform patent-information retrieval and discovery rather than extracting candidate numbers and their positions from supplied text. These are substantive capabilities not disclosed by the description. Although tracing a number to its source could justify some supporting lookup, full-text retrieval and especially similar-patent discovery exceed that purpose. The supplied chunk does not show the client's implementation, so its exact data sources and network behavior cannot be established.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The supplied commands primarily manage and curate an existing candidate collection rather than extract patent numbers from text. CSV export could support the declared extraction workflow, but updating keep/exclude statuses and tracking full-text retrieval are additional capabilities not disclosed by the description. The client implementation is not supplied, so the chunk does not establish network access or actual full-text retrieval.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The command performs a patent-brief operation, which is not part of the declared text-extraction capability. Although the description mentions tracing sources, the supplied command neither processes source text nor preserves candidate locations or context. The client implementation is not provided, so network access or other downstream behavior cannot be confirmed.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Managing a search budget and usage is outside the declared text-extraction purpose, which does not describe patent searching or cost management. The client implementation is not supplied, so the commands do not establish that searches, network access, or charges actually occur.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The supplied code checks an external service's health rather than processing supplied text. No connection between this request and the declared extraction workflow is shown, so it is an undeclared network capability rather than an established supporting implementation detail. The command does not visibly transmit user text or patent numbers.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The shown commands focus on inspecting patent records and substantive document content, not identifying patent numbers with source locations. Although the declared purpose mentions tracing sources, these broader record-browsing and content-search functions are not merely implementation details of number extraction. The chunk does not demonstrate network access or authenticity verification, so neither is inferred.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The command operates on a supplied, already-checked publication number and invokes a patent brief workflow. It does not visibly accept source text, identify candidate numbers, preserve their locations, or classify number types. This is a materially different workflow from the declared extraction purpose. The script implementation is not supplied, so network access or authenticity verification cannot be established from this chunk.

Content

No source excerpt is available for this finding.

Code capability 'network' detected in scripts/patentmax_client.py but not covered by declared permissions.

High

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The file implements authenticated external requests that are unnecessary for the advertised local patent-number extraction task. If the agent invokes these commands without separate authorization, supplied search terms can leave the environment and an existing account can incur charges; this overlaps SDI-1 rather than proving a runtime permission-system bypass.

Content

No source excerpt is available for this finding.

Code capability 'env' detected in scripts/patentmax_client.py but not covered by declared permissions.

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'env' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.

Content

No source excerpt is available for this finding.

The text-extraction skill exposes billable external patent-search and retrieval operations.

High

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The advertised skill extracts candidates from supplied text, but this client additionally offers external searching, retrieval, and billable analysis using automatically discovered credentials. Invocation does not require affirmative spending consent, and the default session has no monetary cap, creating unnecessary disclosure and financial exposure if the agent expands the task.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 16)May include surrounding context.

bash

curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY" \
  "https://api.ip930.com/api/patent?pn=CN109761224A"

服务端自己完成内部寻址，这些前置调用不进用户账单。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 48)May include surrounding context.

服务端直接返回上次的结果、不再扣费；同一个键换了参数会被拒（400）；上一次还在处理中返回 409。

bash

curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY" -H "Idempotency-Key: task42-search-1"   "https://api.ip930.com/api/search?q=%E6%B5%B8%E6%B2%A1%E5%BC%8F%E6%B6%B2%E5%86%B7&ds=cn&size=20"

网络超时、不确定上一次有没有成功时，用同一个键重发，不要换键。