专利盘点

• Outcome: Review
• Latest audit: Oct 19, 2026 · 9:36 AM UTC
• Version: 1.0.1

Overview

This skill is mostly a patent-audit tool, but it needs review because it sends patent queries and API credentials to an external service, persists trial credentials locally, and includes broader paid patent-search workflows than its narrow audit description.

Install only if you are comfortable using PatentMax/IP930 as an external patent-data service. Before running it, confirm PATENTMAX_BASE_URL is unset or points only to the legitimate service, avoid submitting confidential invention details unless you accept third-party processing, watch any paid API usage, and know that trial keys and task caches may be stored locally under ~/.patentmax.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (37)

Tainted flow: 'req' from os.environ.get (line 307, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/patentmax_client.py (reported line 118)May include surrounding context.

python

req.add_header("Content-Type", "application/json")
    req.add_header("Accept", "application/json")
    try:
        with urllib.request.urlopen(req, timeout=30) as response:
            payload = json.loads(response.read().decode("utf-8"))
    except urllib.error.HTTPError as exc:
        message = _server_message(exc.read().decode("utf-8", "replace"))

Tainted flow: 'req' from os.environ.get (line 307, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 94% confidence

Finding

The client builds authenticated outbound requests using PATENTMAX_BASE_URL from the environment and always attaches the bearer API key. If an attacker can influence that environment variable, they can redirect requests to an attacker-controlled host and exfiltrate the API key and patent query data via the Authorization header.

Content

Scanner excerpt · scripts/patentmax_client.py (reported line 318)May include surrounding context.

python

req.add_header(key, value)

    try:
        with urllib.request.urlopen(req, timeout=TIMEOUT) as response:
            payload = response.read()
            # 服务端每个响应都回本次实扣和扣完后的余额。记下来，供 _spent/_balance 输出。
            # 拿服务端的真值，而不是在本地累加估价：跨进程累加迟早算岔，

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill’s declared purpose is a narrow patent portfolio audit, but the instructions indicate broader external-service access, trial/API-key acquisition, billing-related behavior, and auxiliary capabilities not disclosed in the metadata. This is dangerous because users and policy layers may authorize the skill based on a limited description while it actually performs networked, potentially chargeable, data-exporting operations that expand privacy, financial, and trust risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill metadata says this skill is for patent portfolio auditing and asset inventory, but this section instructs the agent to perform broad patent search, novelty-style screening, and related decision workflows. That scope expansion can cause the agent to collect more data than necessary, invoke chargeable external searches, and produce outputs users may over-trust as legal or strategic analysis outside the declared purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

These instructions describe novelty/creativity assessment methods, infringement-adjacent reasoning, and evidentiary comparison practices that go well beyond a patent inventory skill. In context, this increases the chance the agent will generate quasi-legal conclusions or expand into sensitive analysis workflows using tools and sources not justified by the skill's stated function.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

This skill performs outbound network requests to an external API, including sending patent queries and bearer credentials, but the finding indicates network capability is not declared. Missing permission declarations make data egress harder to audit and increase the chance the skill is approved under an inaccurate trust model.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

This skill performs outbound network requests to an external API, including sending patent queries and bearer credentials, but the finding indicates network capability is not declared. Missing permission declarations make data egress harder to audit and increase the chance the skill is approved under an inaccurate trust model.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description and the rest of the file instruct the skill in Chinese and prescribe Chinese output artifacts such as 专利资产清单.csv, but they do not offer the user a language or locale choice. This can violate language/locale policy because the skill appears user-invocable and not clearly limited to a Chinese-only audience by an explicit opt-in or documented constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill directs creation of a local CSV containing an organization’s patent inventory without requiring an explicit warning or confirmation about local file creation and the sensitivity of the resulting data. Even if patent records are public, the compiled inventory, status summary, and expiry flags can constitute sensitive business intelligence and may be written to insecure locations or shared unintentionally.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

L49 instructs users to switch search language based on the database context ("全球库切中文、中国库切英文对应词") as a required step, rather than offering language choice or framing it as optional. This is a natural-language locale policy issue because it prescribes a specific language behavior without explicit user opt-in or a documented policy justification.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The skill sends data to an external service at api.ip930.com and encourages use of user-provided API credentials. In a portfolio-audit context, company names, patent targets, and potentially confidential technical descriptions may be transmitted to a third party, creating privacy, compliance, and billing risk if this is not clearly constrained and consented to.

Content

Scanner excerpt · references/tools.md (reported line 668)May include surrounding context.

试用用完、过期，或想用其他功能（查新、交底书等）时，命令会返回带 "free_trial": true 的错误，message 里写着下一步怎么办（注册 PatentMax 再送 ¥50 体验额度），原样转告用户，不要自己换写法重试。

用户有自己的密钥时用环境变量传，避免写进命令历史；设了就一律用它，不会领试用。密钥在 api.ip930.com 控制台创建：

bash

export PATENTMAX_API_KEY="pm_live_你的密钥"

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file contains natural-language instructions that user-visible error messages are Chinese and should be passed through verbatim. Because no user opt-in or language/locale choice is offered, the skill effectively forces a specific language, which matches the locale-policy violation criteria.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file authorizes use of external public registries and non-patent literature even though the skill is supposed to perform portfolio audits. That broadens data flows and source variability unnecessarily, making outputs less controlled and potentially exposing sensitive user queries or creating inconsistent, non-reproducible results.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The module docstring states that errors include human-readable Chinese prompts, and the file consistently hard-codes Chinese user-facing messages. This is a natural-language locale policy issue because the skill mandates a specific language without any opt-in or alternative locale selection.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill can auto-claim and persist a reusable trial API key to disk without explicit user approval. This expands capability beyond the stated audit task, creates durable credentials on the host, and may bypass expected provisioning and governance controls.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 16)May include surrounding context.

md

# 设了 PATENTMAX_API_KEY 就一律用它，不会去领试用。
TRIAL_SOURCE = "patent-search-cn"
TRIAL_GROUP = "patent-search"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 48)May include surrounding context.

md

# 设了 PATENTMAX_API_KEY 就一律用它，不会去领试用。
TRIAL_SOURCE = "patent-search-cn"
TRIAL_GROUP = "patent-search"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 73)May include surrounding context.

md

# 设了 PATENTMAX_API_KEY 就一律用它，不会去领试用。
TRIAL_SOURCE = "patent-search-cn"
TRIAL_GROUP = "patent-search"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 89)May include surrounding context.

md

# 设了 PATENTMAX_API_KEY 就一律用它，不会去领试用。
TRIAL_SOURCE = "patent-search-cn"
TRIAL_GROUP = "patent-search"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 114)May include surrounding context.

md

# 设了 PATENTMAX_API_KEY 就一律用它，不会去领试用。
TRIAL_SOURCE = "patent-search-cn"
TRIAL_GROUP = "patent-search"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 124)May include surrounding context.

md

# 设了 PATENTMAX_API_KEY 就一律用它，不会去领试用。
TRIAL_SOURCE = "patent-search-cn"
TRIAL_GROUP = "patent-search"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/faq.md (reported line 35)May include surrounding context.

md

# 设了 PATENTMAX_API_KEY 就一律用它，不会去领试用。
TRIAL_SOURCE = "patent-search-cn"
TRIAL_GROUP = "patent-search"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/faq.md (reported line 41)May include surrounding context.

md

# 设了 PATENTMAX_API_KEY 就一律用它，不会去领试用。
TRIAL_SOURCE = "patent-search-cn"
TRIAL_GROUP = "patent-search"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/faq.md (reported line 119)May include surrounding context.

md

# 设了 PATENTMAX_API_KEY 就一律用它，不会去领试用。
TRIAL_SOURCE = "patent-search-cn"
TRIAL_GROUP = "patent-search"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/patentmax_client.py (reported line 78)May include surrounding context.

python

# 设了 PATENTMAX_API_KEY 就一律用它，不会去领试用。
TRIAL_SOURCE = "patent-search-cn"
TRIAL_GROUP = "patent-search"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

Static analysis

No suspicious patterns detected.